3.2 Designing for Compliance PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a best practice for protecting PII in a cloud environment?

   • ADisable audit logging to reduce storage costs
   • BGrant all employees read/write access to PII to improve productivity
   • CStore PII in a publicly accessible bucket for easy access
   • DEncrypt PII both at rest and in transit
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company stores customer PII in Cloud Storage. They need to protect it from unauthorized access and ensure that access is logged. They also need to comply with GDPR's data minimization principle. What should they do?

   • AEncrypt the data with CMEK and store the keys in the same bucket.
   • BUse a single service account for all employees to access the data.
   • CUse IAM to restrict access, enable audit logging, and use Cloud DLP to identify and redact unnecessary PII.
   • DMake the bucket public but rely on encryption.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common industry certification that cloud providers may obtain to demonstrate compliance with security and privacy standards?

   • ATOEFL
   • BIEEE 802.11
   • CISO 27001
   • DITIL
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A multinational corporation must store employee data in the country of each employee due to local labor laws. They are using Google Cloud. They need to ensure that data is not processed outside the country. What is the most effective approach?

   • AUse a single Google Cloud region in a neighboring country and rely on data residency policies.
   • BDeploy separate projects per country, each with resources in the corresponding Google Cloud region, and restrict data access to that region.
   • CEncrypt all data with CMEK and store keys in a single global key ring.
   • DUse Cloud Storage with a multi-region location and set bucket-level retention policies.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company processes credit card payments and stores cardholder data in Cloud SQL. They need to comply with PCI DSS. They also need to monitor for unauthorized access. What should they implement?

   • ATokenize cardholder data before storing it in Cloud SQL.
   • BEnable Cloud SQL encryption with CMEK, restrict access with IAM, and enable audit logging.
   • CStore cardholder data in a separate database with no backups.
   • DUse SSL/TLS for all connections and disable public IP access.
   Reveal Solution Discussion Select an answer first