5.1 Adhering to Regulatory and Industry Standards Requirements for the Cloud PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A compliance team wants to monitor when Google Cloud personnel access customer data. Which Google Cloud feature provides logs of Google personnel access to customer data?

   • AAccess Transparency
   • BCloud Audit Logs
   • CVPC Flow Logs
   • DCloud Monitoring
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company must isolate development and production environments in Google Cloud to meet compliance requirements. They also need to ensure that developers cannot access production data and that all access to production is logged. What should they do?

   • ACreate separate projects for development and production, use IAM roles to restrict access, and enable Data Access audit logs on the production project.
   • BUse a shared VPC for both environments and use firewall rules to restrict traffic.
   • CCreate separate VPCs for development and production, and use VPC peering to connect them.
   • DUse a single project with separate folders for development and production, and use organization policies to restrict access.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A government agency needs to deploy a workload that handles controlled unclassified information (CUI) and must ensure that data is processed only in the United States. They also need to enforce that only US-based Google personnel can access the data. What should they do?

   • ACreate a project in the US region and enable Access Approval.
   • BSet an organization policy to restrict resource locations to the US and use Cloud KMS with US keys.
   • CUse a VPC Service Controls perimeter with US regions and enable Access Transparency.
   • DCreate an Assured Workloads environment with the US region and the appropriate compliance regime (e.g., FedRAMP High).
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which Google Cloud resource hierarchy level is typically used to apply compliance controls to a set of related projects?

   • AResource
   • BProject
   • CBilling account
   • DFolder
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational corporation must process personal data of EU residents only in EU regions. They plan to use BigQuery and Cloud Storage. They also want to prevent any resource from being created outside the EU. What should they do?

   • AUse a single project and set the default location for all resources to the EU.
   • BSet an organization policy to restrict resource locations to EU regions, and create all datasets and buckets in EU regions.
   • CCreate a VPC Service Controls perimeter that includes only EU regions.
   • DUse Assured Workloads with an EU region, and enable Access Approval.
   Reveal Solution Discussion Select an answer first