Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

GCP Security Engineer > Security Engineer > Flashcards

Security Engineer Flashcards

1
Q

What is a GKE network policy?

A

While Firewall Rules are a powerful security measure, and Kubernetes enables you to define even finer grained rules via Network Policies. Network Policies are used to limit intra-cluster communication. Network policies do not apply to pods attached to the host’s network namespace.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can you restrict traffic with a GKE network policy?

A

By pod label or namespace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How are IAM and Kubernetes RBAC different?

A

RBAC is used for restricting access within a GKE cluster. There are no deny rules, only allow rules. IAM is higher level at the node and project level. They are used in conjunction in GKE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What can Binary Authorization do?

A

With Binary Authorization you can whitelist container registries, require images to be signed by trusted authorities, and centrally enforce those policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the Titan security chip do?

A

Enable trusted server boot

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which logs allow you to see if Google has accessed your data?

A

Access Transparency Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What can be used for authentication for GCP resources?

A

Either Google Sign-in or SAML/OIDC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which roles are added when creating an org?

A

Existing users are granted project creator and billing account creator roles - remove these ASAP for people that don’t need them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an org policy?

A

An org policy is a configuration of restrictions, defined by configuring a constraint with restrictions, applied to the org node, folder, or projects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are audit logs?

A

They are logs that record project-level permission changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What scope do firewall rules have?

A

Global within a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the implied firewall rules?

A

Allow all outgoing traffic, block all incoming traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What additional rules does the default VPC allow?

A

the default VPC allows internal, ssh, rdp, and icmp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What VPC traffic is always blocked?

A

Email ports and non-standard protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What firewall rule can be set to prevent exposing ports and protocols unnecessarily?

A

Set low priority firewall rule to deny all ports/protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Does private google API access resolve to a public or private IP address?

A

It is still resolved to a public IP address, but the traffic is all internal and private, and subnet must still have a route to the default-internet-gateway set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the Forseti modules?

A

Inventory, Scanner, Enforcer, Explain, and Notifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does Forseti Inventory do?

A

Saves an inventory snapshot of your GCP resources to Cloud SQL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does Forseti Scanner do?

A

Regularly compares role-based access policies for your GCP resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does Forseti Enforcer do?

A

Uses policies you create to compare the current state to the desired state

21
Q

What does Forseti Explain do?

A

Provides visibility into your cloud IAM policies

22
Q

What does Forseti Notifier do?

A

Priovides ability to notify inventory summary and violations

23
Q

What controls what a Compute Engine VM can access?

A

The VM service account or Scope (legacy). Scope is only used with the default service account.

24
Q

What is the Compute Engine default service account?

A

It’s a project editor, used by default when creating a VM unless you delete the service account or disable it with a policy

25
Q

What does a GCE scope control?

A

It controls access to APIs when using the default service account.

26
Q

How do you enable SSH to linux VMs

A

Add ssh public key to project metadata to enable ssh access to all VMs, or to the VM directly. You can configure individual instances to NOT use project-wide keys.

27
Q

How is data encrypted on GCP?

A

AES-256 with a key per storage block. The keys are then encrypted with AES-256 with a KEK.

28
Q

What is the standard rotation schedule for KEKs?

A

90 days

29
Q

What do customer managed keys allow you to do?

A

Allows you to manage the KEKs and generate keys, set rotation periods, and expire keys

30
Q

Where are KEKs stored?

A

On Google KMS in a keyring. Each keyring can have multiple versions of a key.

31
Q

What is a customer supplied key?

A

Google will never store your key, but you have to provide your own key when creating or using a storage resource

32
Q

At what levels can you grant access to Cloud Storage with IAM?

A

Org, folder, project, or bucket level

33
Q

What can ACLs be used for?

A

Granting access to objects and buckets

34
Q

When should use use IAM vs ACLs for cloud storage access?

A

Usually use IAM and not ACL, unless you need really fine tuned access of objects

35
Q

What is a signed URL?

A

Allows access to Cloud Storage without adding a user to an ACL or IAM, has a timeout

36
Q

What is the other way to allow bucket upload without an ACL or IAM?

A

Signed Policy Documents specify what can uploaded to a bucket with a form POST

37
Q

At what level can you grant BQ access?

A

Org, folder, project, or dataset through IAM

38
Q

How can you restrict access to only a subset of a dataset?

A

Create an authorized view and share that

39
Q

How do you configure an authorized view?

A

Create a second dataset, add a restricted view to the second dataset with access permissions to the first dataset

40
Q

What are the ways to reduce the likelihood or effects of a DDOS attack?

A

Load balancing, reduce the attack surface, restrict to internal traffic only, manage with APIs, offload to CDN, and use products that protect against DDoS

41
Q

What is the Cloud Security Scanner?

A

It scans for web security in App Engine and Compute Engine for cross-site scripting, flash injection, mixed content, clear text passwords, and insecure JS libraries

42
Q

What does it scan?

A

App Engine and Compute Engine - every link it finds except for specifically exluded ones. It can even log in with provided credentials.

43
Q

Where should you run the scanner?

A

In a test environment because it can generate load and change state

44
Q

What is Cloud Identity-Aware Proxy?

A

Proxy that controls access to App Engine, GCE, or GKE, does both authn and authz

45
Q

How does GCP protect against ransomware?

A

Automatically detects and blocks known attacks, scans files in Drive and G Suite tools

46
Q

What is the DLP API?

A

Finds and redacts sensitive data in text and images

47
Q

Which APIs can be used to detect inappropriate content?

A

DLP API, Vision API and Video Intelligence API

48
Q

What does DNSSEC provide protection against?

A

Protects domains from spoofing and poisoning attacks

49
Q

Which 3 places does DNSSEC need to be configured?

A

DNS zone must serve special DNSSEC records to authenticate the content, the top-level domain registry must have a record to authenticate a DNSKEY records in your zone, and the client must use a DNS resolver that validates DNSSEC-signed domains

GCP Security Engineer (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions