Cloud Digital Leader Why cloud technology is transforming business Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Avoid cloud entirely for the new product and build on-premises to eliminate regulatory concerns

  Why it's wrong here

  Building on-premises does not automatically satisfy regulatory requirements; regulators focus on outcomes like data protection and auditability regardless of deployment model. In fact, Google Cloud can provide stronger, more verifiable controls such as region-scoped data residency and tamper-evident audit logs. Moreover, forgoing cloud innovation for a new product sacrifices competitive advantage without reducing regulatory burden.

• ✓

  Demonstrate that Google Cloud provides the specific regulatory controls needed: data residency configuration, comprehensive audit logging, compliance certifications, and contractual frameworks that satisfy the bank's regulatory requirements

  Why this is correct

  The correct response is to map specific regulatory requirements to specific cloud controls. Data sovereignty → configure region constraints. Auditability → Cloud Audit Logs with immutable retention. Compliance → review applicable certifications (ISO 27001, SOC 2, FedRAMP). This addresses concerns with evidence rather than assumptions.

• ✗

  Ignore the risk team's concerns and proceed with cloud development, as regulators have approved cloud for all banking applications globally

  Why it's wrong here

  There is no global regulatory approval for cloud in all banking applications; regulations are jurisdiction-specific and often condition approval on demonstrated technical and organizational controls. Dismissing the risk team's legitimate concerns without evidence would be a governance failure and could expose the bank to sanctions. A responsible approach is to map requirements to concrete cloud capabilities, not to assume blanket acceptance.

• ✗

  Commission a multi-year study to determine whether cloud regulation will change before proceeding

  Why it's wrong here

  A multi-year study would be unnecessary because the regulatory landscape is not static, but current compliance frameworks and certifications like ISO 27001, SOC 2, and FedRAMP already provide a basis to assess adequacy. Waiting would let competitors capture the market while the bank gains no regulatory clarity; regulators expect banks to engage proactively with pilot projects and risk assessments, not to defer action indefinitely.

Go deeper

Related to this question