Google Professional Cloud Security Engineer Question 494
Select 3Google Cloud PlatformYou are a Professional Cloud Security Engineer tasked with ensuring your organization's Google Cloud environment complies with GDPR regulations. Which steps are necessary to determine the Google Cloud resources in scope for regulatory compliance?
- A
Identify all Google Cloud regions where your data is stored or processed.
- B
Review the IAM roles assigned to users to manage resource access.
- C
Analyze the data classification and sensitivity of the data stored in Google Cloud.
- D
Enable Cloud Logging and review audit logs for all resources.
- E
Map workloads and services to specific regulatory requirements.
Show answer and explanation
Correct answers: A, C, E
Explanation
Determining the Google Cloud environment in scope for regulatory compliance involves identifying where data is stored or processed, classifying data to know what is subject to the regulation, and mapping workloads to specific regulatory requirements. These steps ensure your organization can effectively address compliance obligations like GDPR. Other activities, such as reviewing IAM roles or enabling logging, are important for security but do not directly define the compliance scope.
- A. Correct.
Identifying the Google Cloud regions where your data is stored or processed is critical for GDPR compliance, as the regulation has specific requirements about data residency and cross-border data transfers.
- B. Incorrect.
While reviewing IAM roles is essential for security, it is not specific to determining the scope of compliance with GDPR or other regulations.
- C. Correct.
Data classification is necessary to understand which data is subject to GDPR regulations, as only specific categories of data (e.g., personal data) fall under its scope.
- D. Incorrect.
Enabling Cloud Logging is important for auditing and monitoring, but it is not directly related to defining the scope of regulatory compliance.
- E. Correct.
Mapping workloads and services to regulatory requirements is essential to determine which parts of your environment fall under GDPR and to ensure compliance measures are applied appropriately.