Google Cloud IAM Policy Design Quiz

1. What is the purpose of Cloud IAM Conditions?

To encrypt data in transit

To add attribute-based access control

To monitor user activity

To backup IAM policies

2. Which role should be assigned to review security configurations without making changes?

Roles/editor

Roles/owner

Roles/viewer

Roles/securityReviewer

3. What does the Cloud IAM API allow you to do?

Programmatically manage IAM policies

Encrypt data at rest

Monitor network traffic

Scale compute resources

4. How should you handle shared service account keys in production?

Distribute them securely to authorized applications

Avoid using them; prefer Workload Identity

Store them in Cloud Storage

Rotate them monthly without notification

5. What is the primary security benefit of using predefined roles?

They are faster to assign

They follow Google's security best practices

They are cheaper than custom roles

They automatically update permissions

6. Which audit log type records IAM policy changes?

Data Access logs

System Event logs

Admin Activity logs

Cloud Audit logs

7. What is impersonation in the context of Google Cloud IAM?

Using fake credentials

One identity assuming the permissions of another

Cloning user accounts

Encrypting user identities

8. Which Google Cloud service manages workload identities?

Cloud KMS

Workload Identity Federation

Cloud Armor

VPC Service Controls

9. What is the difference between 'allow' and 'deny' policies in Google Cloud IAM?

Allow policies grant permissions; deny policies restrict permissions

Deny policies take precedence over allow policies

Allow policies are default; deny policies require additional setup

Both a and b are correct

10. Which role grants permissions to manage Compute Engine instances?

Roles/compute.admin

Roles/compute.viewer

Roles/compute.networkAdmin

Roles/compute.osAdmin

11. Which principle should guide IAM role assignments in Google Cloud?

Least privilege access

Maximum access for efficiency

Role-based universal access

Time-based temporary access

12. How are IAM policies inherited in Google Cloud?

Child resources override parent policies

Policies are not inherited

Child resources inherit parent policies

Policies are bidirectional

13. What is a resource hierarchy in Google Cloud IAM?

Organization → Folder → Project → Resource

Project → Organization → Folder → Resource

Resource → Project → Folder → Organization

Folder → Project → Organization → Resource

14. Which of the following is a best practice for service account key management?

Store keys in version control

Rotate keys regularly

Share keys across applications

Use the same key for all environments

15. What does the 'roles/iam.securityReviewer' role allow?

Creating and modifying IAM policies

Viewing IAM policies and members

Deleting service accounts

Granting roles to users

16. Which IAM condition type restricts access based on resource location?

Resource name condition

IP address condition

Resource attributes condition

Time-based condition

17. What is the maximum number of keys a service account can have?

2

5

10

No hard limit

18. A service account is best used for which scenario?

Human user authentication

Application-to-application authentication

Multi-factor authentication

Single sign-on integration

19. When should you create a Custom Role instead of using Predefined Roles?

To reduce IAM complexity

When predefined roles grant too many permissions

To improve performance

When you need multi-cloud support

20. What is the primary difference between Basic Roles and Predefined Roles in Google Cloud IAM?

Basic Roles are deprecated; Predefined Roles are current

Basic Roles grant broad permissions; Predefined Roles are service-specific

Predefined Roles are customizable; Basic Roles are fixed

Basic Roles cost more than Predefined Roles

Google Cloud Security Engineer IAM Policy Design Quiz