GCP security

Incorrect — That is upside down; the organization is the root.

Incorrect — Billing is attached to projects, not the hierarchy root.

Incorrect — Projects nest under folders and an organization.

Incorrect — Inheritance is the whole point of the hierarchy.

Incorrect — Grants are additive; there is no override, only union.

Incorrect — It propagates automatically.

Incorrect — Deny policies remove access; they never grant.

Incorrect — It applies to any principal.

Incorrect — Org policies constrain configuration; deny policies constrain IAM permissions.

Incorrect — They can be granted; they are just too coarse.

Incorrect — They apply to any principal.

Incorrect — Roles have no direct cost.

Incorrect — Conditions are logic, not encryption.

Incorrect — They refine grants; they do not bypass constraints.

Incorrect — Unrelated to SA creation.

Incorrect — IAM governs who-can-do-what; org policy governs allowed configuration.

Incorrect — They are enforced.

Incorrect — They inherit from org/folder down.

Incorrect — That increases risk.

Incorrect — That removes visibility.

Incorrect — That is a severe misconfiguration.

Incorrect — Unrelated to networking.

Incorrect — Unrelated to encryption.

Incorrect — Not what this constraint governs.

Incorrect — That is exactly when you build a custom role.

Incorrect — Both are IAM.

Incorrect — Roles are not encryption.

Incorrect — Evaluation cost is the same.

Incorrect — Conditions still apply.

Incorrect — You still scope the role tightly.

Incorrect — Shared logins destroy attribution.

Incorrect — SA keys are static credentials, not for humans.

Incorrect — Org-wide Owner is maximal blast radius.

Incorrect — It analyzes, not encrypts.

Incorrect — Unrelated to rotation.

Incorrect — Not a networking tool.

Incorrect — GCP firewall rules are stateful and instance-targeted.

Incorrect — They govern packets, not API permissions.

Incorrect — Not a resolver.

Incorrect — Neither is encrypted; that is not the difference.

Incorrect — Tags work; SAs are just harder to abuse.

Incorrect — Unrelated to logging.

Incorrect — They filter, not encrypt.

Incorrect — Network control, not authorization.

Incorrect — Not an addressing feature.

Incorrect — The opposite — it keeps them private.

Incorrect — Firewall rules still apply.

Incorrect — IAM still authorizes API calls.

Incorrect — The opposite of its purpose.

Incorrect — Connectivity, not storage encryption.

Incorrect — Unrelated.

Incorrect — NAT is for outbound; inbound uses load balancers.

Incorrect — Not an encryption service.

Incorrect — That is Cloud DNS policies.

Incorrect — That is VPC firewall; VPC-SC guards managed-API data planes.

Incorrect — It is an API perimeter, not a grant.

Incorrect — Unrelated to keys.

Incorrect — That is Cloud Armor’s domain.

Incorrect — Not what perimeters address.

Incorrect — A runtime concern, not VPC-SC.

Incorrect — It is not encryption.

Incorrect — IAM still applies.

Incorrect — Unrelated to logging.

Incorrect — Not an encryption service.

Incorrect — Unrelated to identity.

Incorrect — That is Cloud KMS.

Incorrect — Performance is not the point.

Incorrect — Ingress is filtered too; egress is the neglected half.

Incorrect — Complementary, not a replacement.

Incorrect — That describes standalone VPCs, not Shared VPC.

Incorrect — Not its function.

Incorrect — Firewall rules still apply.

Incorrect — Default encryption is always on.

Incorrect — It applies broadly across services.

Incorrect — Encoding is not encryption.

Incorrect — Performance is not the point.

Incorrect — Key access is governed by IAM.

Incorrect — The opposite of control.

Incorrect — It is a two-tier hierarchy, not double-encryption.

Incorrect — The payload is protected.

Incorrect — Hashing is one-way, not encryption.

Incorrect — Networking, not KMS.

Incorrect — Unrelated to KMS.

Incorrect — Unrelated.

Incorrect — New data uses the new primary; old ciphertext still decrypts with prior versions.

Incorrect — Old data remains readable.

Incorrect — Keys are never public.

Incorrect — EKM adds cost and an availability dependency.

Incorrect — Not a performance feature.

Incorrect — That is the opposite of EKM.

Incorrect — HSM is hardware-backed, not a cost optimization.

Incorrect — It manages keys, not logs.

Incorrect — Unrelated.

Incorrect — The manager adds lifecycle features a file lacks.

Incorrect — Not the value proposition.

Incorrect — The opposite — tighter control.

Incorrect — Baked secrets leak with the image and never rotate.

Incorrect — Source is committed and copied.

Incorrect — A guaranteed leak.

Incorrect — It does not block rotation.

Incorrect — Both actions are logged.

Incorrect — Performance is not the point.

Incorrect — It does not affect performance.

Incorrect — It blocks decrypt; it does not re-encrypt.

Incorrect — The opposite happens.

Incorrect — Only if consumers re-read within the overlap.

Incorrect — Unrelated to rotation mechanics.

Incorrect — Secret Manager supports rotation.

Incorrect — Admin Activity is always enabled; Data Access is the opt-in one.

Incorrect — They record API/admin actions.

Incorrect — They go to Cloud Logging.

Incorrect — They are opt-in (except BigQuery) and can be high-volume.

Incorrect — They record data access, not just auth failures.

Incorrect — They are logs, not encryption.

Incorrect — The goal is retention and centralization, not deletion.

Incorrect — Unrelated.

Incorrect — Sinks route logs; they do not grant access.

Incorrect — It is about integrity, not speed.

Incorrect — It may increase storage cost.

Incorrect — It protects logs, not IAM.

Incorrect — It is a security product.

Incorrect — That is Artifact Registry.

Incorrect — Unrelated.

Incorrect — It detects and raises findings, not inline blocking.

Incorrect — Not an encryption service.

Incorrect — Unrelated.

Incorrect — That is Container Threat Detection.

Incorrect — That is Cloud Armor.

Incorrect — Its scope is far broader.

Incorrect — That is image scanning; CTD is runtime.

Incorrect — That is Event Threat Detection.

Incorrect — Unrelated.

Incorrect — You need the logs feeding it.

Incorrect — Findings stay internal.

Incorrect — Unrelated.

Incorrect — Volume without signal degrades response.

Incorrect — They are signals, not crypto.

Incorrect — Not the primary reason.

Incorrect — It covers control-plane behavior too.

Incorrect — Behavioral signals are high value.

Incorrect — Far broader than that.

Incorrect — Cost is not the reason.

Incorrect — It does not change IAM.

Incorrect — Not its function.

Incorrect — The whole point is to eliminate that key.

Incorrect — The federated identity still gets scoped IAM.

Incorrect — Unrelated to encryption.

Incorrect — Unrelated to identity mapping.

Incorrect — That is the resource hierarchy.

Incorrect — Unrelated to KMS.

Incorrect — They are not; that is the problem.

Incorrect — A committed key is plaintext to anyone with the repo.

Incorrect — They work until deleted.

Incorrect — Unrelated to encryption.

Incorrect — Not a network control.

Incorrect — Unrelated.

Incorrect — That maximizes the escalation surface.

Incorrect — You want it logged.

Incorrect — That reintroduces the static-key risk.

Incorrect — Destroying everything is not measured containment.

Incorrect — Too broad for the immediate threat.

Incorrect — Active compromise is not backlog work.

Incorrect — Deletion discards volatile evidence.

Incorrect — A reboot can wipe memory evidence.

Incorrect — That worsens exposure.

Incorrect — A competent attacker plants a second way in.

Incorrect — Metrics are not persistence indicators.

Incorrect — A weak signal, not the hunt.

Incorrect — Unrelated.

Incorrect — Not a delivery network.

Incorrect — That is Secret Manager.

Incorrect — That is a detective control.

Incorrect — It acts at configuration time.

Incorrect — It is enforced.

Incorrect — Unrelated to encryption.

Incorrect — Not a network control.

Incorrect — Unrelated.

Incorrect — It uses them; it does not replace them.

Incorrect — Runbooks are procedures.

Incorrect — Not its purpose.