PCSE question patterns

An organization policy constraint (boolean, list, managed or custom) set at the organization or folder.

Org policy blocks the setting at creation, regardless of who holds IAM roles.

An IAM deny policy on the permission, with exceptions for a break-glass group.

Deny is evaluated before allow and cannot be bypassed by inherited roles.

The managed feature: CMEK Autokey, Security Command Center, Cloud Armor preconfigured rules, Audit Manager.

Custom scripts and manual reviews carry maintenance the question is trying to avoid.

Google Cloud Directory Sync for users and groups plus SAML SSO to the identity provider.

GCDS provisions accounts one way, SSO authenticates. Neither does both jobs.

Workforce Identity Federation with an organization-level pool and attribute conditions.

External identities are mapped to principals without Cloud Identity accounts.

Workload Identity Federation with a provider, attribute condition on repo or account, and either direct access or service account impersonation.

The external token is exchanged for a short-lived Google token.

Few dedicated accounts, security keys enforced, not used day to day, sign-in alerts, break-glass procedure.

They have unlimited tenant control, so phishing-resistant 2SV and minimal use are the controls.

Grant Token Creator on that service account and use impersonation, not a downloaded key.

Impersonation gives short-lived tokens and logs the developer.

Enforce iam.disableServiceAccountKeyCreation at the organization.

It is a preventive constraint, applied to every project.

Policy Troubleshooter for one principal-permission pair, Policy Analyzer for who-can-access queries.

Troubleshooter evaluates a specific request. Analyzer queries the policy graph.

Privileged Access Manager entitlement with justification, approver and maximum duration.

It issues a temporary role binding and audits it, so no standing privilege exists.

Access Context Manager access levels used in IAM conditions, IAP or VPC Service Controls.

Access levels express device, location and identity context.

Organization policy iam.allowedPolicyMemberDomains.

It blocks granting roles to outside or consumer accounts and allUsers-style exposure.

Cloud Armor policy with preconfigured WAF rules, rate limiting, and Adaptive Protection on the external Application Load Balancer.

Cloud Armor filters at Google's edge before traffic reaches backends.

IAP TCP forwarding with a firewall rule allowing 35.235.240.0/20.

IAP authenticates by identity and tunnels without public exposure.

VPC Service Controls perimeter, tested in dry-run first, with ingress and egress rules for legitimate flows.

IAM allows the user, only the perimeter blocks the API call crossing the boundary.

Cloud NGFW Enterprise with firewall endpoint, security profile group and TLS inspection using a CA Service pool.

Only the Enterprise tier does layer 7 prevention and TLS inspection.

Secure Web Proxy with URL list rules.

Cloud NAT does no filtering, and FQDN firewall rules lack URL-path control.

Target service accounts or IAM-controlled secure tags, not network tags.

Network tags can be set by VM editors, so they are not a trust boundary.

VPN or Interconnect, DNS mapping to restricted.googleapis.com (199.36.153.4/30), or Private Service Connect for Google APIs.

The restricted VIP exposes only APIs that a perimeter can control.

HA VPN, or Cloud Interconnect with MACsec or HA VPN over Interconnect.

Interconnect is private but not encrypted by default.

Private Service Connect endpoint to the service attachment.

It exposes only the service and avoids overlapping IP problems.

Sensitive Data Protection format-preserving encryption with a KMS-wrapped key.

FPE keeps length and character set and is reversible with the key.

Cryptographic hash (HMAC) de-identification.

Hashing is stable for joins and irreversible.

Sensitive Data Protection discovery (data profiles) at organization or folder level.

It profiles continuously without per-table jobs.

Policy tags from a Data Catalog taxonomy, with Fine-Grained Reader, or dynamic data masking.

Column-level security is the BigQuery native way. Row access policies filter rows.

CMEK in Cloud KMS, revoke by disabling or destroying the key.

Google default keys can't be revoked by the customer.

Cloud External Key Manager, with Key Access Justifications if reasons must be checked.

The external key manager holds the key, and Google calls it for every operation.

Cloud KMS Autokey plus gcp.restrictNonCmekServices.

Autokey provisions keys on resource creation, and the policy forces CMEK use.

Secret Manager with secretAccessor granted to the workload service account on that secret, mounted rather than baked in.

It gives versioning, rotation notifications and audit, unlike env vars in code.

Confidential VMs, Confidential GKE Nodes or Confidential Space.

Memory is hardware-encrypted. Shielded VMs only protect boot integrity.

Model Armor templates, with Sensitive Data Protection for data leakage.

It's the dedicated AI request and response filter.

Binary Authorization policy requiring attestations from KMS-keyed attestors, rolled out in dry-run first.

It enforces at deploy time and supports separation of duties across attestors.

Artifact Analysis on-demand scanning in a Cloud Build step.

It scans a local image prior to push and gates the build.

VM Manager OS patch deployments and vulnerability reports.

It's managed, scheduled and reports per instance.

Data Access audit logs, provided they were enabled beforehand.

Admin Activity logs only show configuration changes.

Organization aggregated sink to a locked log bucket or a Cloud Storage bucket with retention lock.

An org sink can't be bypassed per project and locks stop deletion.

Grant the sink's writer identity the right role on the destination.

Sinks write with their own service account, which needs permission.

Log sink to Pub/Sub, then a Dataflow template (or a native integration).

Pub/Sub streams logs near real time to external consumers.

Packet Mirroring to a collector behind an internal load balancer.

Flow logs contain no payload.

Cloud IDS endpoint with a packet mirroring policy.

It detects threats and logs them, and doesn't block.

Security Command Center Premium, Security Health Analytics, with a custom module for company-specific rules.

SHA detects after the fact. Custom org constraints prevent creation.

SCC notification to Pub/Sub triggering Cloud Run or Workflows that remediates, with approval for risky steps.

Event-driven response needs no polling.

Isolate with a deny rule on its tag or service account, snapshot disks to a forensics project, preserve logs, then rebuild from a clean image.

Contain first and keep evidence before destroying the instance.

Assured Workloads folder with the matching compliance regime.

It applies location, service, key and personnel controls and monitors drift.

Access Approval, which needs Access Transparency enabled.

Transparency logs access, and Approval lets you allow or dismiss it first.

gcp.resourceLocations with in:eu-locations, regional resources, same-region keys, logs and backups.

The policy blocks creation elsewhere, but only for new, supported resources.

Audit Manager, with SCC compliance views for continuous status.

It assesses controls and exports evidence for auditors.

Isolate the cardholder environment in dedicated projects and VPC, restrict peering and access, add a VPC-SC perimeter.

Only segmented systems stay out of scope.