6A - Secure a Network in a Cloud Environment

Question 1

You are the cloud operations manager for a shipping and distribution company. Your company utilizes Google Cloud infrastructure to deliver a virtual desktop interface (VDI) to employees. Your company has tasked you with configuring SSH access to the virtual machine (VM) instances for a group of newly-hired employees. The OS Login service provided by Google Cloud will configure PAM Modules. The PAM modules will provide authorization and authentication support to use Google Cloud IAM permissions. This type of support controls SSH access, using an Identity and Access Management (IAM) framework.

Configuration requirements are as follows:
Keys must be SSH-2 RSA public-private key pairs with a minimum length of 2048 bits.
Enable OS Login using the gcloud command-line interface (CLI)
Enable OS Login using the gcloud command-line interface (CLI)
VMs run Ubuntu 20.04 LTS
PROJECT_ID of VM instances will be ship001 and the geographic zone is
Authentication will occur on company-provided Linux devices.
Configure an OpenSSH server to obtain biometric authentication (who you are) or RFID access tags (what you have) from the company-provided Linux devices, using the NSS (Name Service Switch) OS subsystem.
Configure the PAM configuration file, sshd_config, to disable passwords, as the system will use SSH-authenticated biometrics instead.
Google Compute Engine, used through Google Cloud Console or the gcloud CLI, sets a username and generates an ephemeral SSH key pair for each user, before resolving each provided username to the corresponding OS Login account in the VM using NSS service modules.
The SSH key is then retrieved from the corresponding account and provided to OpenSSH in the VM using the SSH authorized keys command.

Question 2

key bit length

Answer 2

2,048

Question 2

key format

Answer 2

SSH-2 RSA

Question 3

enable OS login with gcloud command

Answer 3

enable-oslogin

Question 4

token 2

Answer 4

auth,
sufficient,
pam_fprintf.so,
N/A

Question 4

edit the standard SSH privilegad access module (PAM) located by default at / _____ /pam.d/ _____

Answer 4

blank 1
etc

blank 2
sshd

Question 5

in the google cloud console, grant a standard user role for each new user

Answer 5

roles/iam.serviceAssountUser

Question 6

token 1

Answer 6

auth,
required,
pam_google_authentucator.so,
N/A

Question 7

after spinning up a virtual machine (VM) instance renning ________ you show the new users how to access an instance using the following gcloud command

Answer 7

Ubuntu 20.04.LTS

Question 8

gcloud compute ssh-project= ______ -zone = _______

Answer 8

ship001,
us-central1-a