GCP pen testing methodology