Google Professional Cloud Security Engineer Question 475
Select 3Google Cloud PlatformYour organization is planning to migrate an on-premises application to Google Cloud. The application processes sensitive data, requires low-latency access to storage, and needs to interact with other applications over a secure network. As a Professional Cloud Security Engineer, how should you determine the technical needs for compute, data, network, and storage to ensure a secure and efficient migration?
- A
Select a Google Cloud region and zone closest to the users to minimize latency and comply with data residency requirements.
- B
Use Google Cloud Storage with default settings for data storage, as it automatically provides all necessary security features.
- C
Implement Identity and Access Management (IAM) roles to control access to the application and its associated resources.
- D
Configure a Virtual Private Cloud (VPC) with firewall rules to restrict network access to only the necessary resources.
- E
Choose preemptible VMs to reduce costs, as they are suitable for sensitive, always-on workloads.
Show answer and explanation
Correct answers: A, C, D
Explanation
When migrating sensitive workloads to Google Cloud, it is critical to carefully assess and configure compute, data, network, and storage requirements. Choosing an appropriate region and zone ensures low-latency performance and compliance with data residency requirements. Security measures such as IAM roles and VPC firewall rules help protect resources. However, using default storage settings or preemptible VMs for critical workloads may compromise security and availability. By addressing these factors, you can ensure a secure and efficient migration.
- A. Correct.
Correct: Selecting a region and zone close to users minimizes latency and helps meet data residency requirements, which is crucial for performance and compliance.
- B. Incorrect.
Incorrect: While Google Cloud Storage has strong security features, relying on default settings without configuring additional encryption or access controls may not meet sensitive data requirements.
- C. Correct.
Correct: Implementing IAM roles ensures that only authorized users and services can access the application and its resources, which is a key aspect of cloud security.
- D. Correct.
Correct: Configuring a VPC with firewall rules restricts unnecessary network access, reducing the attack surface and enhancing application security.
- E. Incorrect.
Incorrect: Preemptible VMs are cost-effective but are not suitable for sensitive, always-on workloads due to their ephemeral nature and lack of guaranteed availability.