Google Professional Cloud DevOps Engineer Question 244
Select 3Google Cloud PlatformYou are responsible for designing a CI/CD pipeline for a healthcare application hosted on Google Cloud. The application processes and stores sensitive data, including Protected Health Information (PHI). As part of the pipeline, you need to ensure the security and compliance of the data while adhering to HIPAA regulations. Which of the following actions should you take to handle the sensitive data correctly?
- A
Use Customer-Managed Encryption Keys (CMEK) to encrypt data stored in Google Cloud Storage.
- B
Store sensitive data in environment variables within the CI/CD pipeline configuration for quick access.
- C
Enable Audit Logs for all Google Cloud services used by the application.
- D
Use Secret Manager to store and manage sensitive credentials accessed by the CI/CD pipeline.
- E
Transfer sensitive data to external systems over unencrypted HTTP for faster performance.
Show answer and explanation
Correct answers: A, C, D
Explanation
Handling sensitive data such as PHI requires strict adherence to security and compliance best practices. Using CMEK ensures encryption is under your control, enabling Audit Logs provides traceability, and using Secret Manager secures sensitive credentials. Avoid insecure practices like storing sensitive data in environment variables or transferring it over unencrypted HTTP, as these could lead to data breaches and non-compliance with regulations such as HIPAA.
- A. Correct.
Using Customer-Managed Encryption Keys (CMEK) ensures that you have control over the encryption keys, which is a best practice for handling sensitive data such as PHI. This is compliant with HIPAA regulations.
- B. Incorrect.
Storing sensitive data in environment variables within the CI/CD pipeline configuration is not secure, as it risks exposing the data accidentally. Sensitive data should be handled using secure storage solutions, such as Secret Manager.
- C. Correct.
Enabling Audit Logs for all Google Cloud services provides traceability and helps meet compliance requirements by recording access and usage of resources, which is especially important when handling sensitive data like PHI.
- D. Correct.
Using Secret Manager to store sensitive credentials ensures secure storage and access management. This is a best practice for handling sensitive data in a CI/CD pipeline.
- E. Incorrect.
Transferring sensitive data over unencrypted HTTP is a security risk and violates compliance requirements, such as HIPAA. Data should always be transferred using secure protocols like HTTPS or TLS.