Security » Week 2 » Reliable Google Cloud Infrastructure: Design And Process

Q: What do you have to do to enable encryption when using Cloud Storage?

This answer is correct, because Cloud Storage always encrypts data on the server side before it is written to disk. For server side encryption there are options of customer supplied or customer managed encryption keys, but these are only usually used for compliance reasons and are not necessary.

Q: Which Google Cloud features could help reduce the risk of DDoS attacks?

This answer is correct, because HTTP Load Balancing mitigates and absorbs many layer 4 below attacks such as SYN flood, IP fragment floods, and port exhaustion. CDN caches cacheable content at points of presence close to users. In the event of a DDoS attack for cacheable content, the requests are sent to points of presence, not to your servers/infrastructures, thus increasing the likelihood of the attack being absorbed. Google Cloud Armor is built for DDos mitigation, working with Cloud Load Balancing to detect DDoS attacks.

Q: You don't want programmers to have access to production resources. What's the easiest way to do this in Google Cloud?

This is the correct answer, because the simplest way is to have separate projects and not give developers access to the production project.

Q: What Google Cloud service can you use to enforce the principle of least privilege when using Google Cloud?

This is the correct answer, because the principle of least privilege requires user permissions that are just enough to do what they need, and no more. IAM provides this level of control.