Google Professional Cloud Security Engineer Question 498
Select 3Google Cloud PlatformYour organization needs to comply with a regulatory framework that mandates detailed logging for auditing purposes, network segmentation to limit data access, and role-based access control (RBAC) for resource management. Which combination of Google Cloud services and security controls would best help you meet these requirements?
- A
Use VPC Service Controls to define service perimeters for network segmentation.
- B
Enable Cloud Audit Logs to capture admin activity and data access logs.
- C
Set up Identity and Access Management (IAM) roles to enforce RBAC.
- D
Disable all logging in Google Cloud to reduce storage costs.
- E
Utilize Cloud NAT to ensure compliant logging of public IP addresses.
Show answer and explanation
Correct answers: A, B, C
Explanation
To comply with the regulatory framework's requirements, you need to ensure network segmentation, detailed auditing, and RBAC. VPC Service Controls provide network segmentation, Cloud Audit Logs enable detailed logging, and IAM roles enforce RBAC. Disabling logging would conflict with compliance requirements, and Cloud NAT is unrelated to the specific requirements in this scenario.
- A. Correct.
VPC Service Controls allow you to define service perimeters to segment your network and enforce boundaries, which is critical for regulatory compliance.
- B. Correct.
Cloud Audit Logs provide detailed logging for admin activity and data access, enabling compliance with audit requirements.
- C. Correct.
IAM roles allow you to implement role-based access control (RBAC), ensuring that users only have access to the resources they need.
- D. Incorrect.
Disabling logging would violate compliance requirements as it eliminates the ability to audit activity.
- E. Incorrect.
Cloud NAT is used to manage outbound internet traffic without exposing private IP addresses, but it does not directly contribute to audit logging or RBAC.