Google Professional Cloud Security Engineer Question 471
Select 3Google Cloud PlatformYour organization operates in the healthcare sector and plans to migrate sensitive patient data to Google Cloud. To comply with regulatory requirements such as HIPAA, what steps should you take to ensure adherence to these standards when designing your cloud environment?
- A
Sign a Business Associate Agreement (BAA) with Google Cloud.
- B
Enable encryption at rest and in transit for sensitive data.
- C
Use a publicly accessible storage bucket for patient data to ensure easy access for authorized users.
- D
Implement IAM policies to restrict access to sensitive data based on the principle of least privilege.
- E
Disable audit logging to reduce storage costs and avoid logging sensitive data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To adhere to regulatory standards like HIPAA, organizations must implement a combination of legal agreements, technical controls, and access restrictions. Signing a BAA ensures legal compliance, encryption secures data, and IAM policies enforce access control. Options involving public data exposure or disabling critical features like audit logging are non-compliant and pose significant security risks.
- A. Correct.
Signing a Business Associate Agreement (BAA) with Google Cloud is a critical step in ensuring compliance with HIPAA regulations when handling Protected Health Information (PHI).
- B. Correct.
Encryption at rest and in transit is a fundamental requirement for securing sensitive data and adhering to many regulatory standards, including HIPAA.
- C. Incorrect.
Using a publicly accessible storage bucket for sensitive patient data violates data confidentiality and security principles, making this option non-compliant with HIPAA and other regulations.
- D. Correct.
Implementing IAM policies based on the principle of least privilege ensures that access to sensitive data is restricted to only those who need it, which aligns with regulatory requirements.
- E. Incorrect.
Disabling audit logging is a poor security practice and contradicts compliance requirements, as audit logs are crucial for tracking access and detecting unauthorized activities.