GCP Professional Cloud Architect Practice Question

Your organization must perform a quarterly penetration test against its production workloads hosted in three Google Cloud projects. The security team plans to run credential-brute-forcing, SQL-injection, and low-volume denial-of-service (DoS) checks from an external test network. They want to know what permissions or notifications are required before they start. What should you tell them?

Proceed without notifying Google, provided the tests are limited to your own projects and exclude any traffic-flooding or resource-exhaustion scenarios that would violate the Acceptable Use Policy.
File a notification only if the test targets IAM policies; other attack vectors such as SQL injection or DoS do not require any communication with Google.
Open a support case at least two weeks in advance and wait for written approval from Google before performing any penetration activity.
Request an authorization token through Security Command Center and include the DoS checks because Google permits low-volume DoS tests once the token is issued.

Report Issue

Answer Description

Google no longer requires customers to request or obtain explicit approval before running penetration tests as long as the activity is limited to the customer's own GCP resources and complies with the Acceptable Use Policy (AUP). The AUP forbids tests that could adversely affect Google services or other tenants, including any form of DoS or resource-exhaustion attack. Therefore the team may proceed without filing a request only if they omit the DoS portion of the plan; otherwise the activity would violate the AUP.

The other options are incorrect because:

Google does not offer an approval queue or authorization token for routine penetration tests, and filing a special request is unnecessary.
Cloud Security Command Center does not issue "tokens" for destructive testing, nor does it override the AUP.
IAM-specific probes are treated the same as any other penetration test; no separate notification channel exists.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.