Cloud Digital Leader Google Cloud Security Practice Question
A company must meet regulatory requirements that restrict where data can be stored and processed. They need to ensure that Google Cloud personnel have limited and audited access to their data. Which combination of services should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assured Workloads and Access Transparency
Assured Workloads provides regulatory compliance controls and access restrictions for specific regions. Access Transparency logs Google personnel access. Cloud Audit Logs track user activity. The question asks for a combination that restricts personnel access and provides audit logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access Transparency and VPC Service Controls
Why it's wrong here
VPC Service Controls defines security perimeters that block data exfiltration from a specified service, but it does not enforce geographic data residency or restrict Google personnel access. Access Transparency alone only logs Google engineer access; it does not impose location constraints. Together, these two do not meet regulatory requirements that restrict where data can reside or mandate authorized access controls, so the combination is insufficient.
- ✓
Assured Workloads and Access Transparency
Why this is correct
Assured Workloads is the correct foundation because it enforces data residency by pinning resources to a selected region and imposes access restrictions such as preventing Google personnel from accessing customer data without explicit approval. Access Transparency complements it by providing detailed, audit-ready logs of any Google employee access actions, satisfying the regulatory need for both enforcement and accountability. This pairing directly addresses location restrictions and personnel access tracking, which are the core requirements.
- ✗
Cloud KMS and Cloud Audit Logs
Why it's wrong here
Cloud KMS manages encryption keys and lets you control cryptographic operations, but it has no capability to restrict the geographic location of stored data or limit Google staff access to your workloads. Cloud Audit Logs records actions taken by users and services within your project, such as resource modifications, yet it does not capture logs of Google personnel accessing your data—that function belongs to Access Transparency. Therefore, this combination leaves both location enforcement and personnel access auditing unfulfilled.
- ✗
VPC Service Controls and Cloud Audit Logs
Why it's wrong here
VPC Service Controls establishes perimeters to prevent unauthorized data copying and retrieval across service boundaries, but it does not enforce data residency or provide oversight of Google administrator access. Cloud Audit Logs tracks API calls and administrative activities for your own resources, but it similarly excludes Google's internal support and engineering access events. Because neither component restricts data location nor logs Google personnel actions, this duo fails to satisfy the stated regulatory requirements.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.