1.1 Designing for Security and Compliance PROFESSIONAL-DATA-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is it important to use separate projects for development and production environments?

   • ATo isolate resources and access controls, reducing the risk of accidental changes to production.
   • BTo comply with data residency requirements by storing data in different regions.
   • CTo ensure that development and production use different encryption keys.
   • DTo reduce costs by sharing resources between environments.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In Cloud IAM, what is the relationship between roles, members, and policies?

   • AA policy is a list of resources, and each resource has a member who is granted all permissions by default.
   • BA policy binds a set of members to a role, granting them permissions on a resource.
   • CA member defines a set of permissions, and a role grants those permissions to a policy.
   • DA role is attached directly to a resource, and members are granted access by being added to the resource's metadata.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your healthcare organization is migrating to Google Cloud and must comply with HIPAA. You need to ensure that only authorized personnel can access protected health information (PHI) stored in BigQuery. What is the most important step?

   • AEncrypt all PHI data with customer-managed encryption keys (CMEK).
   • BEnable VPC Service Controls to restrict access to the PHI data.
   • CUse Cloud IAM to grant the principle of least privilege to users and groups that need access to the PHI datasets.
   • DStore PHI data in a separate project with no IAM roles assigned.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   Your company operates in the EU and must comply with GDPR data residency requirements. You are designing a new data platform and need to ensure that all personal data of EU citizens is stored within the EU. What is the most important consideration?

   • AUse customer-managed encryption keys (CMEK) for all data stored in the EU.
   • BSelect a Google Cloud region located within the EU for all resources that store or process personal data.
   • CEnsure that all data is encrypted in transit using TLS.
   • DSet up a VPC Service Perimeter to restrict data access to EU-based resources.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How can you control who can use a Cloud KMS key to encrypt or decrypt data?

   • ABy enabling key rotation, which restricts access to the latest key version.
   • BBy setting a password on the key that must be provided with each request.
   • CBy placing the key in a VPC and using firewall rules to restrict network access.
   • DBy assigning IAM roles on the key, such as Cloud KMS CryptoKey Encrypter/Decrypter.
   Reveal Solution Discussion Select an answer first