Cloud Digital Leader Fundamental Cloud Concepts Practice Question
An organization needs to store confidential healthcare data in Google Cloud. Which compliance certification ensures that Google Cloud infrastructure meets the required security controls for protected health information (PHI)?
⚠ Common exam trap
GCDL often tests whether candidates confuse general security certifications (ISO 27001, SOC 2) with healthcare-specific compliance (HIPAA) — the trap is selecting a broadly recognized standard instead of the regulation that specifically governs PHI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is the U.S. regulation that governs the protection of protected health information (PHI). Google Cloud offers a HIPAA Business Associate Agreement (BAA) and compliance certification for its infrastructure, ensuring the required security controls for storing PHI are met. This is the specific compliance framework for healthcare data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO 27001
Why it's wrong here
ISO 27001 is a certifiable international standard that specifies requirements for an information security management system (ISMS) at a broad organizational level. It does not contain healthcare-specific privacy or security controls, such as those for protected health information (PHI) under HIPAA, nor does it incorporate mandatory breach notification rules or patient rights provisions that are unique to health data regulations.
- ✗
SOC 2
Why it's wrong here
SOC 2 is an attestation report (not a regulation like HIPAA) based on the AICPA's Trust Service Criteria, which cover security, availability, processing integrity, confidentiality, and privacy. While a SOC 2 Type 2 report can provide valuable assurance about a vendor's security and confidentiality controls, it is not a legally binding healthcare data standard and does not require compliance with HIPAA's specific administrative, physical, and technical safeguards for PHI.
- ✓
HIPAA
Why this is correct
HIPAA is a U.S. federal law, not merely a standard, that directly governs the use, disclosure, and storage of protected health information (PHI) by covered entities (e.g., healthcare providers, health plans, clearinghouses) and their business associates. It mandates administrative, physical, and technical safeguards, privacy rule requirements, breach notification protocols, and the use of business associate agreements, making it the definitive regulatory framework for confidential healthcare data in the United States. Choosing HIPAA ensures the storage solution aligns with legal obligations for PHI.
- ✗
PCI DSS
Why it's wrong here
PCI DSS is a prescriptive security standard established by the payment card industry (e.g., Visa, Mastercard) to secure cardholder data and the payment processing environment. It explicitly applies to account numbers, expiration dates, security codes, and related card data, not to medical records or protected health information, so compliance with PCI DSS does not address the confidentiality, privacy, or access requirements for healthcare data under HIPAA.
Go deeper
Related to this question
Learn chapter
ML Lifecycle: Data, Training, Deployment
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Accountability
Accountability is the security principle that ensures actions and identity are linked so that a person or system can be held responsible for their activities.
About these practice questions
Courseiva writes every GCDL question from scratch — 848 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.