Google Professional Cloud Security Engineer Question 499
Select 3Google Cloud PlatformYour company operates in a highly regulated industry and needs to comply with GDPR and PCI-DSS requirements. As part of the compliance initiative, you must ensure that Google Cloud services are configured to meet these standards. Which combination of Google Cloud services and security controls should you prioritize to address the requirements for network segmentation, access control, and audit logging?
- A
Use VPC Service Controls to define service perimeters and restrict access to sensitive data.
- B
Enable Cloud Audit Logs for all services and ensure logs are retained as per compliance requirements.
- C
Use Pub/Sub to stream audit logs in real-time for compliance reporting.
- D
Implement Identity and Access Management (IAM) roles to enforce least privilege access.
- E
Configure Cloud Armor to block unauthorized access to sensitive APIs.
Show answer and explanation
Correct answers: A, B, D
Explanation
Compliance with GDPR and PCI-DSS requires careful implementation of specific security controls. VPC Service Controls help enforce network segmentation, IAM roles ensure access control is aligned with the principle of least privilege, and Cloud Audit Logs provide the necessary audit trail for regulatory requirements. While tools like Pub/Sub and Cloud Armor enhance security, they are not specifically required to meet the outlined compliance standards.
- A. Correct.
VPC Service Controls are designed to create secure service perimeters, which are crucial for network segmentation in compliance frameworks like PCI-DSS.
- B. Correct.
Cloud Audit Logs provide detailed logging for administrative, data access, and system events, which is essential for audit and compliance purposes under GDPR and PCI-DSS.
- C. Incorrect.
While Pub/Sub can be useful for streaming logs, it is not a primary compliance requirement. It is an optional tool for log processing but not directly tied to GDPR or PCI-DSS mandates.
- D. Correct.
IAM roles help enforce least privilege access, a critical requirement for both GDPR and PCI-DSS to ensure that only authorized personnel have access to sensitive data.
- E. Incorrect.
Cloud Armor is primarily used for DDoS protection and blocking malicious traffic. While it enhances security, it is not directly related to compliance requirements for network segmentation, access control, or audit logging.