Cloud Digital Leader Trust and security with Google Cloud Practice Question
A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?
⚠ Common exam trap
Test-takers frequently confuse encryption mechanisms (SSE-C, CSEK, CMEK, SSE-GCP) with HIPAA compliance requirements, mistakenly thinking that any encryption method plus disabling public access or using a VPN is sufficient, when in fact a signed BAA is the non-negotiable contractual requirement for HIPAA compliance with Google Cloud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.
Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.
Why it's wrong here
SSE-C (customer-supplied encryption keys) does encrypt data at rest, but this option fails on two fronts. First, HTTP transmits data in cleartext, exposing PHI to interception during upload/download; TLS/HTTPS is required. Second, Cloud Storage has no 'HIPAA compliance flag' toggle — compliance is achieved by configuration and signing a BAA with Google, not by flipping a switch.
- ✗
Use Cloud Storage with CSEK and disable public access.
Why it's wrong here
CSEK, or customer-supplied encryption keys, gives you control over the key material used for at-rest encryption, but HIPAA compliance demands more. Disabling public access mitigates unintended exposure but does nothing to encrypt traffic as it travels over the network. Moreover, a signed BAA with Google is a mandatory contractual requirement independent of any key management scheme; without it, storing PHI is non-compliant regardless of access controls.
- ✓
Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.
Why this is correct
This is the correct combination because it addresses all three HIPAA requirements. SSE-GCP is Google's default encryption for data at rest, automatically applied without additional key management overhead. HTTPS (TLS) encrypts all data in transit between clients and Cloud Storage, preventing eavesdropping. Signing a Business Associate Agreement (BAA) with Google establishes the necessary legal framework for handling Protected Health Information, making this solution fully HIPAA compliant.
- ✗
Use Cloud Storage with CMEK and use VPN for transit.
Why it's wrong here
CMEK (customer-managed encryption keys) lets you control and rotate keys via Cloud KMS, which is stronger for governance, but it does not remove the obligation to sign a BAA. A VPN creates an encrypted tunnel between your network and Google, yet it only protects traffic that goes through the tunnel; if any client accesses data via HTTPS outside the VPN, or if the VPN is misconfigured, PHI may be exposed. Most fundamentally, HIPAA compliance requires a BAA with Google, and none is mentioned here, so the solution is incomplete.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
SSE
SSE (Security Service Edge) is a cloud-centric security framework that converges web, cloud, and network security into a single edge service.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.