Cloud Digital Leader Google Cloud Security Practice Question
Which layer of Google's defence-in-depth security model includes the use of TLS for data in transit?
⚠ Common exam trap
GCDL often tests layer classification — candidates may associate TLS with 'operational security' because it's an operational control, but Google's model classifies transport encryption under data security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data security
Google's defence-in-depth model organizes controls into layers including data security, operational security, deployment security, and physical security. TLS (Transport Layer Security) protects data in transit by encrypting communications between clients and servers, which falls squarely under the data security layer — the layer responsible for protecting data at rest, in transit, and in use. TLS is a data-protection control, not an operational, deployment, or physical control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data security
Why this is correct
Data security is the correct layer because it directly protects the confidentiality and integrity of the data itself through encryption. Google uses TLS for data in transit and AES-256 (or stronger) for data at rest, managed via Cloud KMS. This layer also includes key management, data classification, and DLP policies.
- ✗
Operational security
Why it's wrong here
Operational security is incorrect here; it focuses on detecting and responding to threats through logging, monitoring, and incident response, not on encrypting data. While it may observe encryption-related events, it does not implement the encryption of data in transit or at rest itself.
- ✗
Deployment security
Why it's wrong here
Deployment security is incorrect because it covers how infrastructure and applications are securely released, such as using CI/CD pipelines, infrastructure as code, and vulnerability scanning of images. These practices prevent misconfigurations but do not perform data encryption; encryption is a separate data-layer control.
- ✗
Physical security
Why it's wrong here
Physical security is incorrect because it protects the hardware (servers, network gear) in data centers using biometrics, guards, and security cages. It ensures only authorized personnel physically access servers but does not encrypt the data stored on those servers; that is the role of the data security layer.
Go deeper
Related to this question
Learn chapter
Responsible AI Framework
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Physical control
Physical controls are tangible security measures like locks, fences, and biometric scanners used to protect buildings, hardware, and sensitive data from unauthorized physical access or harm.
About these practice questions
Courseiva writes every GCDL question from scratch — 848 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.