GCP Security Engineer 练习

Cloud IAM manages permissions and roles. Firewalls, databases, and DNS are different.

Service accounts identify workloads. Human users, firewall rules, and buckets are different.

Custom roles define specific permissions. Built-in roles, DNS records, and firewalls are different.

Organization policies enforce constraints. Firewall rules, DNS records, and load balancers are different.

Workload identity federation connects external identities to Google Cloud. Firewalls, DNS, and load balancers are different.

IAP controls access by identity and context. Firewalls, DNS, and databases are different.

Cloud Identity manages users and devices. Firewalls, databases, and CDNs are different.

IAM groups collect users for role assignment. Firewalls, buckets, and DNS zones are different.

Least privilege limits permissions to what is needed. Full access, encryption, and reports are different.

IAM grants permissions, service accounts identify workloads, IAP proxies access, and organization policies constrain orgs.

Cloud KMS manages encryption keys. Databases, firewalls, and DNS are different.

CMEKs are controlled by customers. Google-managed keys, DNS records, and firewall rules are different.

DLP finds and protects sensitive data. Firewalls, DNS, and load balancers are different.

At-rest encryption protects stored data. Transit encryption, DNS, and firewalls are different.

Transit encryption protects moving data. At-rest encryption, backups, and filtering are different.

Retention policies control data lifecycle. Firewalls, DNS records, and load balancers are different.

Secret Manager stores secrets. Databases, firewalls, and DNS zones are different.

Data access logs record reads and writes. Application logs, DNS records, and buckets are different.

Key rotation replaces keys periodically. Deletion, backups, and filtering are different.

KMS manages keys, CMEKs are customer keys, DLP protects sensitive data, and Secret Manager stores secrets.

Firewall rules filter traffic. Databases, DNS records, and load balancers are different.

Cloud Armor protects web workloads with WAF and DDoS defense. DNS, databases, and load balancers are different.

VPC peering connects VPCs. Public networks, DNS zones, and firewalls are different.

Private Google Access lets VMs reach APIs without public IPs. Public IPs, DNS records, and firewalls are different.

Cloud NAT provides outbound access. Load balancers, DNS servers, and firewalls are different.

Shared VPC centralizes network administration. Public networks, DNS, and backups are different.

Packet mirroring copies traffic for security tools. Blocking, DNS, and IP assignment are different.

VPC-SC creates service perimeters. Firewalls, DNS zones, and load balancers are different.

Private Service Connect provides private access to services. Public sites, DNS, and firewalls are different.

Firewalls filter traffic, Cloud Armor provides WAF/DDoS, VPC-SC creates perimeters, and Private Google Access enables private API access.

GKE hardening applies secure settings. Deletion, DNS, and backups are different.

Binary Authorization controls which signed images deploy. Firewalls, DNS, and load balancers are different.

Container Analysis scans images. Deletion, backups, and filtering are different.

Workload Identity maps Kubernetes identities to Google identities. Firewalls, DNS, and load balancers are different.

Shielded VMs enforce boot integrity. Regular VMs, firewalls, and DNS records are different.

Confidential VMs protect data in use. Regular VMs, firewalls, and load balancers are different.

Patch management applies updates. Deletion, DNS, and filtering are different.

Namespaces isolate resources. VMs, firewalls, and DNS zones are different.

Private clusters avoid public node IPs. Public clusters, firewalls, and DNS records are different.

Binary Authorization signs deployments, Shielded VMs enforce integrity, Container Analysis scans images, and Workload Identity maps identities.

SCC aggregates security findings. DNS, databases, and load balancers are different.

Cloud Logging stores logs. Databases, firewalls, and CDNs are different.

Cloud Monitoring collects metrics and alerts. Warehouses, DNS, and load balancers are different.

Audit logs record admin and data activity. Application logs, DNS records, and buckets are different.

Alerting policies trigger notifications. Firewall rules, DNS records, and load balancers are different.

Event Threat Detection analyzes logs for threats. DNS, databases, and firewalls are different.

Vulnerability scans find weaknesses. Deletion, backups, and filtering are different.

Findings describe detected issues. Firewall rules, DNS records, and load balancers are different.

Log-based alerts trigger from log events. Firewall rules, DNS records, and load balancers are different.

SCC provides posture, Logging stores logs, Monitoring collects metrics, and Event Threat Detection finds threats.

Compliance frameworks define requirements. Firewalls, DNS records, and load balancers are different.

Resource hierarchy organizes Google Cloud resources. Database schemas, firewalls, and DNS zones are different.

Data residency keeps data in selected regions. Deletion, encryption, and reports are different.

Assured Workloads supports regulated environments. Firewalls, DNS, and load balancers are different.

Access Transparency logs Google staff access. Firewalls, DNS records, and load balancers are different.

Quotas limit resource usage. Models, datasets, and DNS records are different.

Labels organize resources. Firewall rules, DNS records, and load balancers are different.

Folders group projects and policies. VMs, firewalls, and DNS zones are different.

Compliance reports document adherence. Backups, firewall rules, and DNS records are different.

Organization policies constrain, resource hierarchy structures, data residency keeps data regional, and Assured Workloads supports regulated environments.