Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

  Why it's wrong here

  This option mistakes the principle of defense in depth for a single, albeit strong, encryption mechanism. Although modern algorithms like AES-256 are robust, any sole control creates a single point of failure—a compromised key or implementation flaw would defeat the entire security posture. True defense in depth layers encryption at the network (TLS), at rest (AES-256 with key hierarchies), and alongside access controls, logging, and anomaly detection, so that no one failure or bypass exposes all customer data.

• ✓

  Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system

  Why this is correct

  This correctly describes defense in depth. Google's infrastructure security has independent layers: secure physical facilities, Titan security chips for hardware attestation, hypervisor isolation between tenants, encrypted network traffic, and IAM at the application layer. An attacker must bypass all relevant layers simultaneously — dramatically harder than defeating a single control.

• ✗

  Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

  Why it's wrong here

  This describes perimeter security, the exact opposite of defense in depth, which relies on a hardened outer boundary while leaving the interior relatively unprotected. Once an attacker breaches the network edge—or a trusted insider acts maliciously—perimeter-only designs offer no further resistance. In Google Cloud, defense in depth applies controls at every layer, including application-level IAM, data encryption, and workload identity, reflecting zero-trust principles that require continuous verification regardless of network location.

• ✗

  Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

  Why it's wrong here

  This statement incorrectly assigns all security duties to customers and reduces Google's role to physical infrastructure alone. In reality, Google Cloud's shared responsibility model allocates security across both parties: Google secures physical facilities, hardware, hypervisors, and network infrastructure, while customers must configure IAM, encrypt data, and patch their workloads. Defense in depth operates within each party's domain, requiring multiple independent controls rather than a single ownership handover.

Go deeper

Related to this question