Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise organization is designing an automated pipeline to route audit logs from multiple production projects to a centralized Cloud Storage bucket in a dedicated security project. The exported logs must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) and protected against data exfiltration using VPC Service Controls.
Which set of actions should the security engineer take to implement this pipeline following the principle of least privilege?
roles/storage.admin to the project's default Compute Engine service account on the bucket, grant roles/cloudkms.admin to the Log Router service account on the CMEK key, and create a Cloud NAT gateway inside the perimeter.This option assigns excessive administrative roles (roles/storage.admin and roles/cloudkms.admin) to broad default identities rather than granting targeted runtime permissions to the dedicated sink writer identity and service agents.
roles/storage.admin allows full control over Cloud Storage buckets, including deleting logs and modifying bucket configurations, violating the principle of least privilege.writerIdentity generated by the Log Router.roles/cloudkms.cryptoKeyEncrypterDecrypter assigned to the storage service agent, not administrative management permissions (roles/cloudkms.admin) assigned to the Log Router.The scenario required provisioning administrative infrastructure rather than implementing runtime least-privilege log routing and encryption.
roles/storage.objectViewer to the sink's writer identity on the bucket, grant roles/cloudkms.cryptoKeyEncrypterDecrypter directly to the sink's writer identity on the CMEK key, and configure an Istio egress gateway on GKE.This option assigns read-only permissions (roles/storage.objectViewer) to the log sink writer identity, grants encryption permissions to the writer identity instead of the storage service agent, and introduces an Istio service mesh egress gateway.
roles/storage.objectViewer grants read-only access to objects; it does not allow the log sink to write or create new log files in the destination Cloud Storage bucket.service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com), not the log sink writer identity.The goal was to route microservice HTTP/mTLS egress traffic out of a GKE cluster to an external monitoring endpoint.
roles/storage.objectCreator to the sink's writer identity on the bucket, grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud Storage service agent on the CMEK key, and include the source and destination projects along with Cloud Storage and Cloud KMS in the VPC Service Controls perimeter.This solution implements a defense-in-depth security model for log export pipelines by combining least-privilege IAM roles, Customer-Managed Encryption Keys (CMEK), and VPC Service Controls (VPC SC) perimeters to safeguard telemetry egress paths.
writerIdentity). Granting only roles/storage.objectCreator on the destination bucket allows the Log Router to upload exported log objects without granting read, list, or overwrite capabilities over existing audit records.service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) to encrypt and decrypt objects, requiring the roles/cloudkms.cryptoKeyEncrypterDecrypter role granted specifically to this service agent.storage.googleapis.com and cloudkms.googleapis.com ensures that log data cannot be exfiltrated to unauthorized cloud projects or external destinations.roles/storage.objectCreator prevents compromised sinks from altering or deleting historical logs.This approach adheres strictly to Google Cloud security best practices by granting the exact minimal permissions required for both the Log Router sink writer identity and the Cloud Storage CMEK service agent, while eliminating unauthorized perimeter egress.
--use-partitioned-tables flag, grant roles/storage.objectAdmin to the Cloud Logging service agent on the bucket, and disable default encryption on the destination storage bucket.This option attempts to configure a Cloud Storage log sink using BigQuery sink flags (--use-partitioned-tables), assigns broad object administration permissions (roles/storage.objectAdmin), and suggests disabling default encryption.
--use-partitioned-tables flag is specific to BigQuery sink destinations, not Cloud Storage buckets.roles/storage.objectAdmin grants full object manipulation capabilities (including object deletion), which is broader than the necessary roles/storage.objectCreator role.The destination was a partitioned BigQuery table and the organization did not require CMEK or VPC SC controls.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated