Cloud Digital Leader Trust and security with Google Cloud Practice Question
A healthcare company must comply with HIPAA and store all protected health information (PHI) only in the United States. They use Google Cloud and want to prevent any accidental data storage outside the US. Which two services should they implement?
⚠ Common exam trap
Google Cloud often tests the distinction between data *protection* (DLP, IAP, Cloud Armor) and data *residency enforcement* (VPC Service Controls, Organization Policies), leading candidates to confuse content inspection or access control with geographic restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Service Controls and Organization Policies
VPC Service Controls create a security perimeter around Google Cloud resources, preventing data from being copied or moved outside allowed regions. Organization Policies allow you to set a constraint (e.g., `gcp.resourceLocations`) that restricts where resources like Cloud Storage buckets or BigQuery datasets can be created, ensuring PHI remains in the US. Together, they enforce both data exfiltration prevention and location-based resource creation restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VPC Service Controls and Organization Policies
Why this is correct
VPC Service Controls create a data security perimeter that restricts access to Google Cloud resources and prevents data exfiltration through context-aware enforcement. Organization Policies, when configured with location constraints, explicitly limit resource creation to approved geographic regions, ensuring HIPAA data residency requirements are met. Together, they enforce both the boundary and the storage location for regulated data.
- ✗
Data Loss Prevention API
Why it's wrong here
The Data Loss Prevention (DLP) API inspects, classifies, and optionally redacts sensitive data such as PHI, but it operates at the data-content level, not the infrastructure level. While DLP can scan existing resources for policy violations, it lacks the ability to block the creation of resources in unapproved regions, making it insufficient for enforcing geographic storage restrictions alone.
- ✗
Identity-Aware Proxy
Why it's wrong here
Identity-Aware Proxy (IAP) authenticates and authorizes user access to applications and services based on identity and context, but it operates entirely at the access-control layer. IAP does not influence where cloud resources are provisioned or stored, so it cannot prevent data from being placed in a non-compliant region. Its scope is user-to-resource access, not resource-to-region placement.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a network security service that provides DDoS mitigation and web application firewall (WAF) capabilities, filtering traffic at the edge of Google's network. It inspects HTTP/HTTPS requests and responses to block malicious traffic, but it has no awareness of the geographic location of underlying data storage. Cloud Armor protects the network layer, not data residency compliance.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.