Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is designing a hardened infrastructure baseline on Google Cloud for a self-managed machine learning training pipeline. The training workloads will execute on a Google Kubernetes Engine (GKE) cluster utilizing GPU-accelerated node pools. The organization has mandated the following security requirements:
Which combination of infrastructure and platform security controls fulfills these requirements?
This option configures disk-level encryption using Cloud KMS CMEK for persistent disks, attempts to restrict metadata endpoint queries using legacy metadata concealment (--workload-metadata=SECURE), and assigns the default Compute Engine service account to cluster worker nodes.
kube-env and instance tokens, leaving the node service account token exposed.Editor or broad IAM roles across the project.The goal was solely to enforce customer key control over data at rest on boot/data persistent disks rather than protecting data in use in physical memory or securing containerized pod authentication.
This option provisions standard general-purpose N2 instances, attempts to implement client-side encryption across GPU video memory, and turns on legacy v0.1 Compute Engine metadata server endpoints.
v0.1 and v1beta1 metadata server endpoints are completely deprecated and disabled due to security vulnerabilities (they lacked required metadata headers, exposing tokens to Server-Side Request Forgery attacks).Metadata-Flavor: Google header and represent a major security anti-pattern.The scenario focused exclusively on managing administrative SSH access to standard Linux VM instances via central IAM identities without containerization or hardware-level memory confidentiality.
This option sets up an API boundary using VPC Service Controls (VPC SC) around storage services, disables Secure Boot on GKE nodes to simplify custom driver injection, and configures container pods with hostNetwork: true.
hostNetwork: true allows pods to bypass network namespace isolation, expose node-level networking, and directly reach the instance metadata server, completely undermining container identity security.hostNetwork: true grants containers access to the host loopback device and host network interfaces, rendering container-level firewalling ineffective.The primary requirement was establishing a network perimeter to prevent data exfiltration to unauthorized Google Cloud projects or external endpoints, provided host-level hardening and in-memory encryption were out of scope.
This architecture combines hardware-level isolation, cryptographically verified boot integrity, secure cloud identity federation, and private networking to establish a zero-trust computing baseline for sensitive artificial intelligence (AI) and machine learning (ML) training workloads on Google Kubernetes Engine (GKE).
This approach adheres directly to Google Cloud security best practices for AI/ML workloads by combining Confidential Computing with native GKE hardening controls without operational friction or deprecated features.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated