Google Cloud Digital Leader — All Questions
3 questions
A security team wants a centralized service to gain visibility into misconfigurations, vulnerabilities, and active threats across all of their Google Cloud resources. Which service is designed for this?
- a.Security Command Center✓
- b.Cloud SQL
- c.Pub/Sub
- d.Compute Engine
Security Command Center provides centralized visibility into an organization's Google Cloud resources, surfacing misconfigurations, vulnerabilities, and threats so teams can find and fix risks. Cloud SQL is a database, Pub/Sub is messaging, and Compute Engine provides virtual machines. Security Command Center is the security posture and threat-visibility tool described here.
An architect designs a system with layered controls, network firewalls, strict identity permissions, and encryption, so that no single failure exposes the whole system. Which security principle does this illustrate?
- a.Single sign-on
- b.Defense in depth✓
- c.Lift-and-shift
- d.Pay-as-you-go pricing
Defense in depth layers multiple, overlapping security controls, such as network, identity, and encryption controls, so that bypassing one does not compromise the system. Single sign-on is an authentication convenience, lift-and-shift is a migration approach, and pay-as-you-go is a pricing model. Layered, redundant protection is precisely defense in depth.
Under the cloud shared responsibility model for an IaaS deployment, which of the following is typically the customer's responsibility?
- a.Securing the physical data center facilities
- b.Configuring identity and access controls and securing their own data and applications✓
- c.Maintaining the underlying hardware and hypervisor
- d.Protecting the global network backbone between regions
In the shared responsibility model, Google secures the underlying infrastructure, hardware, and physical facilities, while the customer is responsible for securing their data, applications, and access configuration such as IAM. Physical security, hardware, and the network backbone are Google's duties. Configuring access controls and protecting one's own data is the customer's share.