Cloud Digital Leader Trust and security with Google Cloud Practice Question
A healthcare company runs its critical application on Google Cloud. The application uses Cloud SQL for patient records, Cloud Storage for medical images, and Pub/Sub for data ingestion. The security team requires that all data at rest be encrypted with a key that is managed and rotated by their on-premises HSM. They also need to ensure that any potential data exfiltration is immediately detected and prevented. Recently, a vulnerability scan revealed that a Cloud SQL instance had a public IP. The team wants to enforce that no Cloud SQL instance can be created with a public IP across the entire organization. Additionally, they need to implement a solution to monitor and alert on any suspicious activity, such as a large download from Cloud Storage. They have a limited budget and cannot afford complex custom solutions. Which combination of Google Cloud services should they use to meet these requirements?
⚠ Common exam trap
Google Cloud often tests the distinction between key management options (CMEK vs. EKM vs. Cloud HSM) and the difference between detection (Cloud Audit Logs, Event Threat Detection) and prevention (VPC Service Controls), leading candidates to choose a solution that only detects but does not prevent data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud External Key Manager (EKM) for encryption, define an Organization Policy constraint to prohibit public IPs on Cloud SQL, deploy Security Command Center with Event Threat Detection to monitor for data exfiltration, and implement VPC Service Controls to limit data access.
Cloud External Key Manager (EKM) allows you to use an external key management system (on-premises HSM) for encrypting data at rest in Google Cloud services like Cloud SQL, Cloud Storage, and Pub/Sub. The Organization Policy constraint `constraints/sql.restrictPublicIp` can enforce that no Cloud SQL instance is created with a public IP. Security Command Center with Event Threat Detection provides out-of-the-box monitoring and alerting for suspicious activities like large downloads from Cloud Storage, while VPC Service Controls adds a data exfiltration prevention layer by restricting data movement outside a defined service perimeter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use CMEK with Cloud KMS for encryption, set an Organization Policy to restrict public IPs on Cloud SQL, and configure Cloud Audit Logs with alerting via Cloud Monitoring to detect data exfiltration.
Why it's wrong here
This option uses CMEK with Cloud KMS, but Cloud KMS is a software-based key management service that does not integrate with an on-premises HSM; the healthcare company's requirement for external key custody mandates Cloud EKM instead. While an Organization Policy can enforce the prohibition of public IPs on Cloud SQL, Cloud Audit Logs with Cloud Monitoring alerting only records API activity and cannot reliably detect sophisticated data exfiltration patterns, such as gradual data transfers or encrypted payloads. Lacking VPC Service Controls and Event Threat Detection, this configuration provides neither active exfiltration prevention nor robust threat detection.
- ✓
Use Cloud External Key Manager (EKM) for encryption, define an Organization Policy constraint to prohibit public IPs on Cloud SQL, deploy Security Command Center with Event Threat Detection to monitor for data exfiltration, and implement VPC Service Controls to limit data access.
Why this is correct
This is the correct answer because Cloud External Key Manager (EKM) integrates with an on-premises HSM, enabling the healthcare company to maintain control of encryption keys outside Google Cloud, satisfying the key management requirement. An Organization Policy constraint that prohibits public IPs on Cloud SQL is the proper resource-level enforcement mechanism. Security Command Center with Event Threat Detection monitors network and API activity for signs of data exfiltration, while VPC Service Controls creates a security perimeter that prevents data from being copied or transferred out of authorized services, addressing both detection and prevention.
- ✗
Use default encryption with Google-managed keys, set an IAM condition to deny public IP on Cloud SQL, and configure Cloud Data Loss Prevention to detect sensitive data exfiltration.
Why it's wrong here
Default encryption with Google-managed keys fails the key management requirement because the healthcare company must use an on-premises HSM for key custody, which only Cloud EKM supports. An IAM condition controls permissions on existing resources but cannot prevent a user from creating a Cloud SQL instance with a public IP address; that requires an Organization Policy constraint. Cloud Data Loss Prevention (DLP) is designed for discovering and classifying sensitive data, not for real-time monitoring of exfiltration events, so it cannot replace Event Threat Detection or VPC Service Controls.
- ✗
Use Cloud HSM for encryption, create a VPC firewall rule to block all incoming traffic to Cloud SQL, and use Cloud Armor to protect against data exfiltration.
Why it's wrong here
Cloud HSM is a Google-managed hardware security module that does not connect to the customer's on-premises HSM, so it does not satisfy the external key custody requirement; Cloud EKM is the only option that integrates with an on-prem HSM. A VPC firewall rule can block traffic to an instance but does not prevent Cloud SQL from being assigned a public IP address, as that is a resource configuration governed by Organization Policy. Cloud Armor provides protection against web application attacks such as DDoS and OWASP Top 10 threats, not data exfiltration, which requires Event Threat Detection and VPC Service Controls.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.