Cloud Digital Leader Fundamental Cloud Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Physical security of data centers

  Why it's wrong here

  Physical security of Google Cloud data centers, including guards, biometric access controls, surveillance, and perimeter defenses, is entirely managed by Google. Customers have no physical access or control over these facilities, so this is not a security control the customer would implement. Under the shared responsibility model, physical security always falls on the provider, regardless of the workload sensitivity.

• ✓

  Implementing IAM policies to restrict access to healthcare data

  Why this is correct

  Customers must implement Cloud IAM policies to enforce least privilege and restrict access to healthcare data to authorized users and services. This involves creating custom roles, binding roles to principals, and applying organizational policies to define who can view or modify sensitive datasets. In the shared responsibility model, data access governance is explicitly a customer obligation; Google only provides the underlying identity management infrastructure. For healthcare data, this is critical for HIPAA compliance and to meet data access audit requirements.

• ✗

  Hardware maintenance of storage servers

  Why it's wrong here

  Google is responsible for the lifecycle management of storage servers, including hardware provisioning, patching firmware, and replacing failed components. Customers cannot schedule or perform hardware maintenance on cloud infrastructure, as they do not manage the physical hosts. Therefore, hardware maintenance is not a control that the customer implements for healthcare data security. This separation of duties is central to the shared responsibility model, where infrastructure operations remain with Google.

• ✗

  Network infrastructure security

  Why it's wrong here

  Network infrastructure security—such as protecting the hypervisor, network devices, and internal backbone—is provided by Google, so it is not a customer-implemented control for securing healthcare data. While customers must configure VPC firewalls and Cloud VPN to protect their own network boundaries, the underlying physical and virtual network infrastructure is fully managed. Misattributing this responsibility to the customer reflects a misunderstanding of the shared responsibility model. For sensitive data, customer-side network controls complement Google's infrastructure security but do not replace it.

Go deeper

Related to this question