Google Professional Cloud Security Engineer Question 482
Select 3Google Cloud PlatformYour organization is deploying a web application on Google Cloud using Compute Engine instances, Google Cloud Storage, and Cloud Load Balancing. As a Professional Cloud Security Engineer, you are tasked with ensuring that the shared responsibility model is followed correctly. Which of the following responsibilities falls under your organization’s scope?
- A
Configuring IAM policies to restrict access to the Compute Engine instances.
- B
Ensuring that Google Cloud's physical data centers are secure and compliant with industry standards.
- C
Keeping the operating system on the Compute Engine instances up to date with patches.
- D
Managing the availability and reliability of Cloud Load Balancing as a service.
- E
Encrypting sensitive data stored in Google Cloud Storage using customer-managed encryption keys (CMEK).
Show answer and explanation
Correct answers: A, C, E
Explanation
In the shared responsibility model, Google Cloud manages the security of the cloud infrastructure, including physical data centers and managed services. However, customers are responsible for securing their data, managing access controls, and maintaining the security of resources they control, such as Compute Engine instances and encryption configurations.
- A. Correct.
Configuring IAM policies is your organization's responsibility because it involves managing access to your resources and is part of the customer's role in the shared responsibility model.
- B. Incorrect.
Ensuring the physical security and compliance of Google Cloud's data centers is Google's responsibility, not the customer’s, as part of the shared responsibility model.
- C. Correct.
Keeping the operating system patched on Compute Engine instances is the customer’s responsibility because the instances are under customer control.
- D. Incorrect.
Managing the availability and reliability of Cloud Load Balancing is Google Cloud’s responsibility as it is a managed service provided by Google.
- E. Correct.
Encrypting sensitive data with CMEK is the customer’s responsibility since it involves the use of customer-managed keys and securing their data.