Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter

  Why it's wrong here

  Strong external firewall rules are designed to filter traffic crossing the network boundary, blocking external attackers from reaching internal services. However, an insider threat is an authenticated user already inside the corporate network perimeter, and they connect through internal paths or directly to resources, so perimeter firewalls never see or evaluate their sessions. Even if a malicious insider exfiltrates data to an external destination, the firewall only inspects packet headers and ports; it does not understand data-level context like which project or dataset is being accessed, nor does it prevent an authorized user from legitimately reading data they have permission to read. Thus, relying on perimeter firewalls leaves the insider's authorized accesses and actions entirely unrestricted, making this control ineffective for this threat model.

• ✓

  Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions

  Why this is correct

  This layered approach addresses insider threat from multiple angles: least privilege limits what a malicious insider can access; audit logs detect anomalous behavior (bulk data access, unusual hours); VPC Service Controls prevent copying data to personal or competitor GCP projects; separation of duties requires collusion for the most dangerous actions.

• ✗

  Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data

  Why it's wrong here

  CMEK protects against unauthorized access to encrypted storage media. Authorized users with access to the encrypted data and decryption keys can still read it — encryption doesn't restrict access for users already authorized to use the data.

• ✗

  Requiring all employees to pass annual security training to prevent insider threats

  Why it's wrong here

  Security training addresses accidental insider threat (mistakes) but doesn't prevent deliberate malicious insiders who know the rules and choose to violate them. Technical controls (audit logging, least privilege) are needed for detecting and limiting deliberate insider actions.

Go deeper

Related to this question