Cloud Digital Leader Trust and security with Google Cloud — 20 Questions

Question 1

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Option B is correct because Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 2

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

Accepted Answer

Zero Trust security model. The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Answer

Perimeter security model

Answer

Defense in depth model

Answer

Principle of least privilege

Question 3

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

Accepted Answer

Google handles physical security, hardware maintenance, and OS and database software patching.. In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Answer

Google controls who can access the database and what data can be stored.

Answer

Google is responsible for backing up customer data and ensuring data recovery.

Answer

Google determines which compliance certifications the customer's application must meet.

Question 4

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Option B is correct because Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 5

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

Accepted Answer

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries). Option B is correct because the `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Answer

`roles/bigquery.admin`

Answer

`roles/viewer` (project-level Viewer)

Answer

`roles/bigquery.dataEditor`

Question 6

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.. Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Answer

Security Command Center — it scans BigQuery for sensitive data automatically.

Answer

Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.

Answer

Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.

Question 7

When data is transmitted between a user's browser and a Google Cloud-hosted web application over HTTPS, which security protection does this provide?

Accepted Answer

It encrypts data in transit between the user's browser and the server, preventing eavesdropping and tampering.. HTTPS (HTTP over TLS) encrypts the communication channel between the user's browser and the web server using Transport Layer Security (TLS). This ensures that any data transmitted, such as login credentials or API requests, is protected from eavesdropping and tampering while in transit. It does not protect data at rest or control access to cloud management interfaces.

Answer

It prevents unauthorized users from accessing the Google Cloud Console.

Answer

It encrypts data stored in the server's database.

Answer

It authenticates the user and verifies their permissions to use the application.

Question 8

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

Accepted Answer

Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.. Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Answer

Access Transparency shows customers which Google Cloud services are available in their region.

Answer

Access Transparency is a feature that makes all customer data visible to Google for quality improvement.

Answer

Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.

Question 9

A company stores its data in Google Cloud. The security team asks: can Google employees access our customer data without our knowledge or consent? What does Google's commitment ensure?

Accepted Answer

Google commits that customer data is not accessed without authorization, with access logged via Access Transparency and governed by contractual data processing commitments.. Option B is correct because Google Cloud's Access Transparency feature logs all data access attempts by Google personnel, and contractual data processing commitments under the Cloud Data Processing Addendum (CDPA) prohibit unauthorized access. This ensures that customer data is not accessed without explicit authorization, and any access is logged and auditable, aligning with the security team's concern about knowledge and consent.

Answer

Google employees have unrestricted access to all customer data as part of the infrastructure service agreement.

Answer

Google uses customer data to train its global AI models to improve services.

Answer

Customer data stored in Google Cloud is automatically accessible by government agencies on request.

Question 10

A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?

Accepted Answer

Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.. Option A is correct because the `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Answer

Enable Cloud Armor on all load balancers to block non-EU traffic.

Answer

Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.

Answer

Enable Google Workspace's regional storage settings to restrict where emails are stored.

Question 11

What compliance certification verifies that an organization's Information Security Management System (ISMS) meets internationally recognized standards for managing information security risks?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through risk management processes. This certification is recognized globally and is the primary standard for ISMS compliance.

Answer

SOC 2 Type II

Answer

PCI DSS

Answer

FedRAMP

Question 12

A company uses Google Workspace for identity. They want employees to use their Google Workspace credentials to access third-party applications (Salesforce, Slack, etc.) without separate passwords for each app. Which technology enables this?

Accepted Answer

Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.. Option B is correct because Single Sign-On (SSO) using SAML 2.0 or OIDC allows Google Workspace to act as the Identity Provider (IdP), issuing authentication tokens that third-party applications (like Salesforce and Slack) trust. This eliminates the need for separate passwords, as users authenticate once with Google Workspace and the IdP handles subsequent access via security assertions or ID tokens.

Answer

VPN — employees connect to the corporate VPN which provides access to all apps.

Answer

Cloud Armor — blocks unauthorized access attempts to applications.

Answer

Shared service account — all employees use the same credential.

Question 13

A company's security policy requires all employees to verify their identity using more than just a password when accessing Google Cloud resources. What security feature enforces this requirement?

Accepted Answer

Multi-factor authentication (MFA) / Two-step verification (2SV).. Multi-factor authentication (MFA) / Two-step verification (2SV) is the correct answer because it explicitly requires users to provide two or more verification factors (e.g., something you know, something you have, something you are) to access Google Cloud resources. This directly enforces the policy of verifying identity beyond just a password, as MFA/2SV adds an additional layer of security by requiring a second factor such as a time-based one-time password (TOTP) from an authenticator app, a hardware security key (e.g., FIDO2), or a push notification. Google Cloud Identity Platform supports this via security key enforcement and 2SV policies, ensuring that password compromise alone is insufficient for access.

Answer

Password complexity requirements — enforcing long, complex passwords.

Answer

IP allowlisting — only allowing access from office IP addresses.

Answer

Session timeout — automatically logging out users after 30 minutes of inactivity.

Question 14

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Option C is correct because Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 15

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

Accepted Answer

Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.. Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Answer

Data Access audit logs — they capture all read and write operations.

Answer

System Event audit logs — they capture all Google Cloud operations.

Answer

Cloud Monitoring logs — they track all changes to monitored resources.

Question 16

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 17

A company stores customer data in Google Cloud and wants to ensure data confidentiality in the event that hardware is decommissioned and returned by Google. How does Google protect customer data when storage hardware reaches end of life?

Accepted Answer

Google uses approved data erasure and physical destruction processes (shredding, degaussing) for decommissioned storage media before hardware leaves its facilities.. Option B is correct because Google Cloud follows strict data destruction policies for decommissioned storage media. Before any hardware leaves Google's facilities, it undergoes approved data erasure (e.g., NIST SP 800-88 compliant wiping) followed by physical destruction (e.g., shredding, degaussing) to ensure customer data cannot be recovered. This process guarantees data confidentiality even if the hardware is returned or recycled.

Answer

Google transfers customer data to new hardware first, then ships the old hardware to the customer for self-destruction.

Answer

Customer data on decommissioned hardware is automatically encrypted, making it safe to discard without wiping.

Answer

Customers must pay a data destruction fee to ensure their data is wiped from decommissioned hardware.

Question 18

A company uses Google Cloud and has a compliance requirement to store certain data only within the European Union and ensure it cannot be accessed from outside the EU, even by Google operations personnel. Which Google Cloud offering specifically addresses this level of data sovereignty?

Accepted Answer

Sovereign Controls offerings (e.g., T-Systems Sovereign Cloud) or Assured Workloads with data residency and personnel access controls.. Option B is correct because Sovereign Controls offerings (such as T-Systems Sovereign Cloud) and Assured Workloads with data residency and personnel access controls are specifically designed to meet strict data sovereignty requirements. These solutions ensure that data remains within the EU and that Google operations personnel cannot access it, addressing both geographic storage and access restrictions mandated by compliance frameworks like GDPR.

Answer

Selecting EU regions for all resources in the Cloud Console.

Answer

VPC Service Controls — they prevent data from leaving the VPC boundary.

Answer

Cloud Armor — it blocks requests originating from outside the EU.

Question 19

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

Accepted Answer

Security Command Center (SCC) — unified security posture management across all GCP projects.. Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Answer

Cloud Monitoring — it detects security anomalies through metric analysis.

Answer

Cloud Audit Logs — they show all API calls that could indicate security issues.

Answer

Cloud DLP — it scans all resources for sensitive data exposure.

Question 20

A company wants to know: if Google Cloud experiences a data breach that exposes customer data, what are Google's notification obligations under standard Cloud service terms?

Accepted Answer

Google will notify affected customers of personal data breaches without undue delay per its Data Processing Addendum, enabling customers to meet their own regulatory notification obligations.. Option B is correct because Google Cloud's standard Data Processing Addendum (DPA) contractually obligates Google to notify affected customers of personal data breaches without undue delay after confirmation. This enables customers to fulfill their own regulatory notification requirements under laws like GDPR or CCPA, as the customer remains the data controller responsible for end-user notifications.

Answer

Google has no obligation to notify customers of data breaches — customers must discover breaches themselves.

Answer

Google will notify all media outlets immediately upon breach detection to maximize transparency.

Answer

Breach notification is only available to customers with Premium support tier.