✅ Q1

Which IAM resource hierarchy is recommended?

🟩 Use multiple projects with established trust boundaries, and change the resource hierarchy to reflect company organization.
❌ Keep all resources in one project
❌ Keep all resources in one project but change hierarchy
❌ Flat hierarchy with multiple projects

Explanation:

Google best practice =
✔ Multiple projects
✔ Clear trust boundaries
✔ Org → Folders → Projects matching company structure

---

✅ Q2

IAM setup for multiple separated components?

🟩 Use separate service accounts for each component with predefined/custom roles.
❌ Basic roles
❌ One service account per component
❌ Basic roles with single SA

Explanation:

Predefined/custom roles = least privilege.
Each component = dedicated service account.

---

✅ Q3

Which is a correct user story?

🟩 As a shoe retailer, Michael wants to send Cymbal Direct custom purchase orders so that batches of custom shoes are sent to his customers.
❌ Persona description
❌ Needs description
❌ Company bio

Explanation:

User story = As a <role> … I want … so that <benefit>.

---

✅ Q4

How to allow a VM to access Google Cloud services safely?

🟩 Create a service account with predefined/custom roles for needed services.
❌ Project owner
❌ Multiple service accounts per service
❌ Access scopes

Explanation:

Use one VM service account with least privilege roles.

---

✅ Q5

Best IAM setup for scalable access control?

🟩 Grant predefined roles to groups, with access as low in the hierarchy as possible.
❌ Custom roles only
❌ Direct individual assignment
❌ Higher-level inheritance advice incorrect

Explanation:

Groups + predefined roles = scalable + secure.

---

✅ Q6

Block brute force IP attack?

🟩 Use Cloud Armor with Allow default and Deny rule for the attacking IP, applied to backend service.
❌ Deny default → blocks everything
❌ Local firewall + Armor mix
❌ Enable Armor on VM (Armor works on LB only)

---

✅ Q7

Block public access but allow API calls?

🟩 Remove external IPs, use private VPC behind Cloud NAT, and manage SSH via IAP/bastion.
❌ Firewall only
❌ Restricting external IP but still using them
❌ Blocking all outbound traffic (breaks APIs)

---

✅ Q8

Cloud Run function secured for employees only?

🟩 Use Google Group + IAP + “IAP-secured Web App User” role.
❌ Armor
❌ Project Owner
❌ VPN

Explanation:

IAP is the best solution for authenticating users to Cloud Run or HTTPS services.

---

✅ Q9

Ensure developers use Cloud Run instead of old manual SQL dump process?

🟩 Create a custom role restricting abilities, remove cloudsql.instances.export.
❌ ACL only
❌ Disabling VPN
❌ Predefined role cannot remove export ability

---

✅ Q10

PCI-DSS continuous compliance?

🟩 Enable SCC Premium + Asset Discovery + Security Health Analytics → View PCI-DSS in Compliance tab.
❌ Vulnerabilities tab
❌ Standard tier
❌ Standard + Vulnerabilities

---

🧾 Summary Table

---