Cloud Digital Leader Why Cloud Technology Can Transform Business Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Armor

  Why it's wrong here

  Cloud Armor is a web application firewall (WAF) and DDoS mitigation service that operates at the edge of Google's network to filter HTTP(S) traffic based on security policies. While it can block malicious requests and volumetric attacks, it does not create an isolation boundary around your data or enforce fine-grained user-level access control to GCP APIs and resources. PCI DSS requires both network segmentation between cardholder data environments and strict access controls, which Cloud Armor alone cannot provide.

• ✗

  Cloud NAT

  Why it's wrong here

  Cloud NAT (Network Address Translation) allows private VM instances to initiate outbound connections to the internet while preventing unsolicited inbound traffic from reaching them. It is a networking feature that manages egress connectivity, not a security control for isolating sensitive data or enforcing identity-based access policies. Under PCI DSS, you need logical segregation of the cardholder data environment and authenticated, per-user access restrictions; Cloud NAT does not address either of these requirements.

• ✓

  VPC Service Controls and IAM

  Why this is correct

  VPC Service Controls and IAM together provide defense-in-depth for PCI DSS compliance: VPC Service Controls establishes perimeters around GCP services to prevent data exfiltration and limit access to authorized networks, while IAM manages granular user-level permissions on specific resources. This combination gives you both network-level isolation (via service perimeters) and identity-based access control (via roles and policies), directly satisfying PCI DSS requirements for restricting access to cardholder data and protecting it from unauthorized retrieval or copying.

• ✗

  Cloud VPN

  Why it's wrong here

  Cloud VPN creates an encrypted IPsec tunnel between an on-premises network and a Google Cloud VPC, enabling secure hybrid connectivity. It is a data-in-transit encryption mechanism, but it does not create isolation between workloads inside GCP, nor does it enforce access control policies on GCP resources or APIs. For PCI DSS, you still need separate controls to segment the cardholder data environment and manage user permissions, which Cloud VPN leaves entirely unaddressed.

Go deeper

Related to this question