Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

GCP > Security > Flashcards

Security Flashcards

1
Q

Cloud Armor

A

WAF - web application firewall
Layer 7 web app firewall
Prevents DDoS, cross site scripting, SQL injections attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Service account email format

A

[name]@[project_id].[service name].gserviceaccount.com

[name]@appspot.gserviceaccount.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

IAM Conditions

  • Definition
  • Language conditions expressed in
A

Access control based on attributes of a resource

Common Expression Language (CEL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Network Tags

A

User level annotation for Compute Engine resources

Used to define security groups, network segment, firewall rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Resource Tags

A

Key value pairs that can be attached to an org, folder, project

Can be used to conditionally allow or deny policies based on whether a resource has a specific tag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security Marks

A

Security Command Center annotations for findings and assets for searching, selecting, filtering
Can group marks for policy, integration with workflow, flag for priority, access level, sensitivity classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Labels

A

User level annotation, metadata for resources
Used for billing and admin
Not inherited by children resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

IAM policies written in what format

A

JSON

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Clou IAM API functions (3)

A

Set policies on resources
Read policies on resources
Test whether an identity has a permission on a resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IAM Conditions resource attributes (3)

A

Type of resource
Resource name
Tags attached to resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IAM conditions request attributes (3)

A

Access level
Date and time
Destination IP and port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Identity Aware Proxy

A

Layer 7 based access control for HTTP requests
IAP protected resources can only be accessed via proxy by principal with correct IAM role
Allows fine grained access control and user grouping without requiring VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Organization policy constraint

A

Rule that prevents action or configuration on service or group of services
Implemented across an org

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Data at rest encryption occurs at which levels (3)

A

Platform - database and file data

Infrastructure - data grouped into data chunks in storage system

Hardware - storage device itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Infrastructure level encryption

  • keys used
  • encryption type
A

DEK
KEK
AES256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data in transit encryption

  • Data outside Google network (1)
  • Data inside Google network (2)
A

Data outside Google network - authenticated but not necessarily encrypted

Data inside Google network

  • HTTP/HTTPS to GFE - TLS or QUIC
  • Within GCP infrastructure - ALTS for authentication and encryption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Default encryption keys used

A

Google issued and managed DEK and KEK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cloud KMS

  • Definition
  • Key type
  • Keys from
  • Key managed by
  • Key rotation
A 
Hosted key management
AES, RSA, EC
Customer generated or imported keys
Customer managed by Google hosted
Auto key rotation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cloud HSM

  • Definition
  • Key type supported
A

GCP hosted HSM to host keys and perform cryptographic operations in a cluster of FIPS 140-2 Level 3 certified HSMs
Cloud KMS as frontend

20
Q

CMEK

A

Cloud managed encryption keys

Keys managed by customers using Cloud KMS

21
Q

Cloud EKM

A

Cloud External Key Manager

Allows customers to manage keys outside GCP and use Cloud KMS to use keys

22
Q

OS Login

A

Enabled through VM instance custom metadata
For SSH access to VM
Ties Linux accounts to Google identities and Cloud IAM

23
Q

Common uses for Organization Policy constraints (3)

A

Limit resources sharing based on domain
Limit usage of IAM service accounts
Restrict physical location of newly created resources

24
Q

Ways to restrict access to resources (4)`

A

Organization Policy Services
Tags
IAM Conditions
VPC Service Controls

25
Q

VPC Service Control

A

Clients within perimeter do not have access to resources outside
Data can’t be copied to unauthorized resources
Data exchanged between clients and resources separated by perimeter secured via ingress and egress rules

26
Q

Confidential computing services (3)

A

Confidential VMs
Confidential GKE Nodes
Dataproc Confidential Compute

27
Q

Confidential VM

A

Encrypts memory to protect data in use
Isolates guests and hypervisor
Provides vTPM attestation everytime AMD SEV boots

28
Q

K8 Role Based Access Control

A

K8 mechanism for fine grained access control to any object or type of object in cluster, or in specific Namespace in cluster

29
Q

BeyondCorp Enterprise

A

Google’s zero trust solution

Context based user and device authorization and authentication

30
Q

Cloud IDS

A

Creates Google managed peered network that has mirrored VMs
Palo Alto Networks threat protection technology to mirror and inspect traffic
For detecting network intrusions and app performance

31
Q

Workload Identity

A

Allows K8 service account in GKE cluster to act as an IAM service account.

Pods authenticate as IAM service account when accessing Google Cloud APIs

32
Q

Which services support CSEK

A

Compute Engine

Cloud Storage

33
Q

Acccess Transparency Log

A

Logs of actions by Google staff when accessing customer content

34
Q

CMEK and CSEK used to encrypt what for Cloud Storage objects (3)

A

Object data
Object’s CRC32C checksum
Object’s MD5 hash

35
Q

reCAPTCHA Enterprise

A

Finds Bots

provides risk score for progressive action based on risk

36
Q

Web App and API Protection solution components (3)

A

Cloud Armor
reCAPTCHA Enterprise
API Security with Apigee

37
Q

Secure Software Development Lifecycle with GCP - End to End Policy Services

A

Cloud Code
Cloud Build
Artifact Registry

38
Q

Secure Software Development Lifecycle with GCP - Binary Auth Services

A

Cloud Deploy

Run - cloud run, cloud functions, GKE

39
Q

Container Analysis service

A

Provides vulnerability scanning for containers in Artifact Registry and Container Registry

Continual analysis

40
Q

Binary Authorization works for which GCP platforms (4)

A

Cloud Run
GKE
Anthos Service Mesh
Anthos clusters on VMware

41
Q

Shielded VM

A

VMs with firmware that secures boot

42
Q

Security Command Center

A

Cloud Asset Inventory - find, monitor, analyze GCP assets
Security Health Analytics - Identifies misconfigurations and baselines
Web Security Scanner - Finds web app vulnerabilities
Event Threat Detection - Finds threats via platform logs
Container Threat Detection - Finds top suspicious activity in container deployments

43
Q

Open Source Insights

A

Tool to see dependencies, security advisory, license across open source code

44
Q

Device Management

A

API to manage corporate devices and control corporate data on devices

45
Q

Safe Browsing / Web Risk API

A

Lets client apps check URLs against Google’s list of unsafe web resources

46
Q

Titan C

A

Chip to protect users against phishing attacks
Enables 2 factor auth
Protects OS from tampering
**Chrome devices

47
Q

Web Security Scanner

A

Crawls app following all links and URLs and attempts to exercise user inputs and event handlers to look for vulnerabilities

GCP (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions