Task 3.1: Designing for security.

• AA VPC Service Controls perimeter around the production projects

  Correct

  A service perimeter blocks API calls that would move data from protected projects to resources outside the perimeter, even when the caller has IAM access.

• BAn IAM deny policy covering the BigQuery Data Viewer role's permissions

  Incorrect

  Denying the read permissions would stop legitimate use too, and deny rules do not consider where the data is going.

• CCustomer-managed encryption keys for the datasets and buckets

  Incorrect

  CMEK controls the encryption key; anyone allowed to read the data can still copy it in clear text.

• DAn organization policy that blocks external IP addresses on VMs

  Incorrect

  This limits VM internet exposure but does not stop API-based copies to another project.

IAM decides who can access data; VPC Service Controls decides where it can go. A perimeter mitigates exfiltration by insiders with valid credentials, which IAM alone cannot.

• AKeep keys in each data project and grant the data owners Cloud KMS Admin on their own keys

  Incorrect

  Data owners could then disable or destroy the keys and grant themselves usage, breaking both rules.

• BGrant the security team Owner on the key project and the data team Owner on the data projects

  Incorrect

  The Owner role includes both administration and use of keys, so it does not separate the duties.

• CKeep keys in a separate project; grant admins Cloud KMS Admin and the service agent Encrypter/Decrypter

  Correct

  This follows Cloud KMS separation of duties: administrators manage keys without using them, and only the BigQuery service agent can encrypt and decrypt.

• DRely on Google default encryption and restrict who can read each dataset with IAM roles

  Incorrect

  Default encryption uses Google-managed keys, so there are no customer keys whose duties could be separated.

Cloud KMS separation of duties keeps key managers apart from key users and recommends that the encrypting service's service account be the only principal that uses a CMEK key. A dedicated key project run by the security team keeps the data owners away from key administration.

• AA bastion VM with an external IP address, OS Login and Shielded VM enabled

  Incorrect

  OS Login ties SSH to identities, but the team would still run and patch a bastion host.

• BIAP TCP forwarding, with a firewall rule allowing the IAP source range

  Correct

  IAP TCP forwarding tunnels SSH to VMs without external IPs and checks each user's identity and IAM permission before connecting.

• CHA VPN tunnels from each administrator's office into the VPC

  Incorrect

  VPN gives network-level access and adds endpoints to operate, which the team wants to avoid.

• DExternal IP addresses on the VMs, with SSH limited by firewall

  Incorrect

  Giving the VMs external IPs exposes them to the internet, the opposite of the goal.

IAP TCP forwarding brokers administrative SSH and RDP connections to VMs that have no external IP addresses, and it checks each user's IAM permission before connecting, so no bastion host is needed.

• ACloud Armor security policies on the chatbot's load balancer

  Incorrect

  Cloud Armor policies act on HTTP requests at the load balancer; they do not judge what a prompt or a model response means.

• BModel Armor templates applied to the prompts and the responses

  Correct

  Model Armor screens prompts and model responses for prompt injection, jailbreaks and harmful content against configurable thresholds.

• CSensitive Data Protection inspection of every chat transcript

  Incorrect

  Sensitive Data Protection looks for sensitive data types such as PII; it does not detect jailbreaks or prompt injection.

• DA VPC Service Controls perimeter around the Agent Platform project

  Incorrect

  A perimeter limits where data can move between services; it does not inspect prompt content.

Securing AI is a guide topic of its own. Model Armor sits in front of and behind the model to filter malicious inputs and harmful outputs, which network and data controls do not do.

• ARotate the service account key automatically every 30 days

  Incorrect

  Rotation shortens a key's life, but the pipeline still depends on a long-lived key.

• BStore the key in Secret Manager and have the workflow read it during each run

  Incorrect

  Moving the key to Secret Manager changes where it lives, not the fact that a key exists.

• CUse an API key restricted to the Cloud Run Admin API instead

  Incorrect

  A standard API key associates requests with a project and does not identify a principal that IAM can authorize to deploy; it is also a long-lived credential itself.

• DSet up Workload Identity Federation that trusts GitHub's OIDC tokens

  Correct

  The workflow exchanges its GitHub OIDC token for short-lived Google credentials, so no service account key exists to leak.

Workload Identity Federation is the recommended way for external CI/CD systems to reach Google Cloud. It removes the maintenance and security burden of service account keys.

• ACloud Armor rules that block requests from unscanned images

  Incorrect

  Cloud Armor filters HTTP requests at the edge; it has no say in which images a cluster runs.

• BWorkload Identity Federation for GKE on every node pool

  Incorrect

  It gives Pods Google credentials; it does not check where an image came from.

• CShielded GKE Nodes enabled on each of the cluster's node pools

  Incorrect

  Shielded nodes strengthen the security of the node VMs themselves; they do not decide which container images may run.

• DBinary Authorization with a policy that requires attestations

  Correct

  Binary Authorization enforces at deploy time that images meet a policy, such as carrying attestations from the build and the scan.

• EArtifact Analysis scanning of the images in Artifact Registry

  Correct

  Artifact Analysis scans images in Artifact Registry for known vulnerabilities, producing the results the attestation step relies on.

Software supply chain security on GKE combines scanning the artifacts with enforcing a deploy-time policy, which is what Artifact Analysis and Binary Authorization do together.

• AA Cloud Identity account created for each new viewer

  Incorrect

  Cloud Identity manages an organization's own users and groups, not a public audience of app customers.

• BA workforce identity pool that holds the viewers' accounts

  Incorrect

  Workforce Identity Federation gives an organization's workforce access to Google Cloud; it is not customer sign-in for an app.

• CIdentity Platform integrated into the web and mobile apps

  Correct

  Identity Platform is a customer identity and access management service that supports email and password, Google, Apple and other sign-in methods, with SMS-based MFA.

• DIdentity-Aware Proxy placed in front of the apps' backends

  Incorrect

  IAP decides who may reach an application; it does not give viewers self-service sign-up, social sign-in and MFA on its own.

Consumer sign-in is customer identity and access management. Identity Platform provides the sign-in methods, SDKs and MFA for an app's users, whereas Cloud Identity and Workforce Identity Federation serve an organization's own people.

• ASecret Manager, with each workload granted access to the secret in IAM

  Correct

  Secret Manager stores versioned secrets with IAM-based access and audit logging, and the application reads the secret at run time instead of from source control.

• BKeep it in a Kubernetes Secret manifest that stays in the Git repository

  Incorrect

  The password would still live in source control, and a Secret manifest only encodes it.

• CPass it as a build substitution in the Cloud Build config for each deploy

  Incorrect

  The value ends up in build configuration and history, with no rotation or access audit.

• DEncrypt it with Cloud KMS and keep the ciphertext in a Cloud Storage bucket

  Incorrect

  This works but is a custom secret store, without built-in versions and rotation.

Secret management is a named part of data security. A dedicated secret store with IAM, versions and audit logs is better than hiding secrets in code or configuration.

• ACloud HSM keys in a FIPS 140-2 Level 3 cluster used as customer-managed keys

  Incorrect

  Cloud HSM keys are protected by HSMs, but those HSMs are hosted and run by Google.

• BCloud KMS software keys rotated automatically every 30 days by schedule

  Incorrect

  Rotation limits a key's lifetime, but the key material still lives in Google Cloud.

• CCloud External Key Manager with keys in the bank's own external key manager

  Correct

  Cloud EKM uses keys that stay in a supported external key manager, which the bank controls and can use to deny access, including by Key Access Justifications.

• DGoogle default encryption at rest with access restricted by IAM and audit logs

  Incorrect

  Default encryption uses Google-managed keys, which gives the bank no external control.

Key management options range from Google-managed to fully external. When keys must stay outside Google and the customer must be able to refuse their use, Cloud EKM is the option.

• AA conditional IAM binding with an expiry time that an admin adds by hand for each incident

  Incorrect

  An expiring binding limits the duration, but there is no request and approval workflow.

• BPrivileged Access Manager entitlements with an approval step and a maximum duration

  Correct

  PAM grants just-in-time, temporary elevation through entitlements that can require approval, and records audit logs of the grants.

• CA break-glass account whose password is shared through the team's password vault

  Incorrect

  A shared account hides who acted and is not tied to an approval per use.

• DPermanent Owner grants to the on-call group, with Data Access audit logs turned on

  Incorrect

  Standing privilege is the risk the team wants to remove; logging does not reduce it.

Least privilege includes time. Privileged Access Manager replaces standing privilege with approved, time-bound grants that are fully audited.