Google Professional Cloud Security Engineer Question 469
Select 3Google Cloud PlatformYour organization operates in the healthcare industry and is migrating its infrastructure to Google Cloud. To ensure compliance with regulatory and industry standards, such as HIPAA, what steps should you take when designing your cloud environment?
- A
Enable Cloud Audit Logs to monitor and log access to sensitive data.
- B
Use customer-managed encryption keys (CMEK) to encrypt all sensitive data at rest.
- C
Deploy resources in any Google Cloud region, as all regions automatically comply with HIPAA.
- D
Sign a Business Associate Agreement (BAA) with Google to ensure HIPAA compliance.
- E
Rely solely on Google's built-in compliance certifications without taking additional security measures.
Show answer and explanation
Correct answers: A, B, D
Explanation
To adhere to HIPAA regulations, organizations must take specific actions when designing cloud environments on Google Cloud. Enabling Cloud Audit Logs ensures traceability and monitoring of sensitive data access. Using customer-managed encryption keys (CMEK) allows organizations to manage data encryption directly. Additionally, HIPAA compliance requires a signed Business Associate Agreement (BAA) with Google. While Google Cloud supports compliance frameworks, organizations must still play an active role in implementing security and compliance measures.
- A. Correct.
Correct. Cloud Audit Logs provide a way to monitor and audit access to sensitive data, which is a critical requirement for HIPAA compliance.
- B. Correct.
Correct. Using customer-managed encryption keys (CMEK) gives your organization control over data encryption, which is an essential part of meeting regulatory requirements like HIPAA.
- C. Incorrect.
Incorrect. Not all Google Cloud regions may automatically comply with HIPAA. You must select regions that explicitly support HIPAA compliance.
- D. Correct.
Correct. Signing a Business Associate Agreement (BAA) with Google is a necessary step to ensure HIPAA compliance when handling healthcare-related data.
- E. Incorrect.
Incorrect. While Google Cloud provides built-in compliance certifications, organizations are still responsible for implementing additional security measures to comply with HIPAA.