Google Professional Data Engineer Question 1
Select 3Google Cloud PlatformYou are designing a data pipeline in Google Cloud for a healthcare organization that must adhere to HIPAA compliance. Which of the following actions should you take to ensure the pipeline is both secure and compliant?
- A
Enable Identity and Access Management (IAM) roles to control access to sensitive data.
- B
Encrypt data in transit using SSL/TLS and at rest using Cloud Key Management Service (KMS).
- C
Ensure data is stored in a single region to optimize performance rather than compliance.
- D
Use VPC Service Controls to define service perimeters for your data pipeline.
- E
Allow unrestricted public access to external APIs to facilitate data sharing with third parties.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure HIPAA compliance and secure design for your data pipeline, you must implement robust access controls (IAM roles), encrypt data both in transit and at rest, and use VPC Service Controls to establish security perimeters. These measures protect sensitive healthcare data from unauthorized access and adhere to compliance standards. Avoid actions like allowing public access or prioritizing performance over security.
- A. Correct.
Correct. IAM roles are essential for controlling access to data, ensuring that only authorized entities can access sensitive information, which aligns with HIPAA requirements.
- B. Correct.
Correct. Encrypting data in transit and at rest is a fundamental security principle that ensures data confidentiality and integrity, meeting HIPAA compliance.
- C. Incorrect.
Incorrect. Storing data in a single region is not necessarily a compliance requirement and prioritizes performance over security and compliance.
- D. Correct.
Correct. VPC Service Controls add an additional layer of security by creating service perimeters to protect sensitive data from unauthorized access.
- E. Incorrect.
Incorrect. Allowing unrestricted public access compromises data security and violates compliance standards like HIPAA, which require strict access controls.