GCP Professional Cloud Architect Practice Question

Your security team plans a penetration test against a new microservice hosted on Cloud Run in a production project. They ask whether they must file a request with Google before launching the test and which activities are out of scope. Which statement correctly reflects Google Cloud's penetration-testing policy for customer resources?

Customer-initiated penetration tests are prohibited; Google conducts all such testing on behalf of tenants.
They may begin testing without prior approval as long as they stay within their own project and avoid disruptive techniques such as denial-of-service traffic.
They can freely generate large-scale volumetric traffic across Google's network during the test, because any action inside their project is permitted.
They must submit a penetration-testing request to Google Support at least seven days in advance and wait for written approval.

Report Issue

Answer Description

Google Cloud's policy allows customers to carry out penetration tests against resources in their own projects without advance notification or approval, provided the activities comply with the Acceptable Use Policy. The AUP explicitly forbids actions that could disrupt Google's infrastructure or other tenants, including denial-of-service or volumetric traffic floods. Therefore, customers may initiate the test immediately, but they must avoid disruptive techniques such as DoS attacks. The other options either require unnecessary prior approval, permit prohibited traffic floods, or incorrectly state that customers cannot test their workloads.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.