Cloud Digital Leader Google Cloud Security Practice Question
Which defense-in-depth layer includes measures like access controls, vulnerability management, and intrusion detection systems?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Operational security
Operational security involves the policies and procedures to protect data and systems during operation, including access controls, vulnerability scanning, and intrusion detection. Physical security covers hardware and facilities; infrastructure security covers network and platform; data security covers encryption and data loss prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data security
Why it's wrong here
Data security is wrong because this layer is concerned with protecting the data itself through encryption, data classification, tokenization, and data loss prevention (DLP) policies. It does not encompass the operational processes of managing user access or continuously monitoring systems. The layer described in the question—access controls and intrusion detection—relies on operational workflows and governance rather than data-centric protections.
- ✗
Physical security
Why it's wrong here
Physical security is wrong because it addresses threats to the physical environment where systems reside, such as data center access controls, biometric entry systems, and security guards. Logical access management and intrusion detection systems (IDS) operate at the application and network layers, not at the physical perimeter. These technical controls are implemented and maintained by operational security processes, not by physical site protections.
- ✓
Operational security
Why this is correct
Operational security is correct because it encompasses the day-to-day processes and controls that protect systems, including user access management (authentication, authorization, least privilege), vulnerability management, continuous monitoring, and incident response. These are precisely the measures described in the question—access control lists and intrusion detection—which require ongoing operational discipline rather than static architectural safeguards. This layer ensures that policies and procedures are executed consistently across the environment.
- ✗
Infrastructure security
Why it's wrong here
Infrastructure security is wrong because this layer covers foundational technology safeguards such as network segmentation, security groups, patch hardening, and platform configuration baselines. While it may include some access controls like firewalls or ACLs at the network level, it is not focused on the broader operational procedures of monitoring and vulnerability management that characterize the operational security layer. The question asks about management and monitoring practices, which belong to operations, not infrastructure design.
Go deeper
Related to this question
Learn chapter
Google Cloud Infrastructure
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.