Security Flashcards
What is the principle of separation of duties?
A security principle that ensures no single individual has control over all aspects of any critical process.
What does ‘defense in depth’ refer to?
A layered security approach that uses multiple security measures to protect data.
What is the default encryption status of data in Google Cloud?
Everything is always encrypted at rest and in transit.
What is BeyondCorp?
A security model that focuses on identity rather than network location.
What is Cloud Identity?
An Identity as a Service (IDaaS) solution that centrally manages users and groups.
What does Cloud Identity prevent?
Prevents users from using personal accounts to access corporate resources.
How can existing corporate directories like Microsoft AD be used with Cloud Identity?
By scheduling a one-way sync using Google Cloud Directory Sync (GCDS).
What is the purpose of Identity and Access Management (IAM) in Google Cloud?
It provides authorization controls to Google Cloud resources.
What is a role in IAM?
A collection of permissions granted to users.
What are primitive roles in IAM?
Basic roles that are project-level and often too broad.
What are predefined roles in IAM?
Roles that provide granular access to specific resources.
What is the maximum number of member bindings allowed per IAM policy?
1,500 member bindings.
True or False: Child policies can restrict access granted at a higher level.
False.
What are IAM Conditions used for?
To define and enforce conditional, attribute-based access for resources.
What is the best practice regarding IAM roles?
Use groups instead of individual accounts.
What is the command to undelete a custom role within 7 days?
gcloud iam roles undelete.
What do service accounts provide?
An identity for carrying out server-to-server interactions.
What is Cloud Armor?
Edge-level protection from DDoS and other attacks on global HTTP(S) LB.
What does the Cloud DLP API do?
Finds and optionally redacts sensitive information in unstructured data streams.
What is Cloud Security Command Center (Cloud SCC)?
GCP’s SIEM for reviewing and managing security across services.
What is Cloud KMS?
Google’s low-latency service to manage and use keys.
What is the purpose of Cloud HSM?
To host encryption keys and perform cryptography operations.
Fill in the blank: All data on GCP is encrypted in transit and at rest by default using _______.
customer-supplied encryption keys.
What is the 24-hour delay in Cloud KMS for?
To prevent accidental or malicious data loss during key deletion.
What are service accounts authenticated with?
Keys.
What is the function of the Activity Analyzer?
To see reports about service accounts’ latest usage.
What is the role of Organizational Policy Service?
To provide centralized control over the organization’s cloud resources.
What are ‘Security Marks’ used for in Cloud SCC?
To group, track, and manage resources.
What is a characteristic of Google App Engine’s Security Scanner?
It is free but limited and has very low false positive rates.
