Supporting Compliance Requirements practice questions

Google personnel access restrictions

Why wrong: Google personnel access restrictions is an optional control, not automatically enabled; it requires manual configuration.

VPC Service Controls

Why wrong: VPC Service Controls are not automatically enabled; they must be configured separately.

Cloud Armor WAF

Why wrong: Cloud Armor WAF is not automatically enforced by Assured Workloads.

Set a retention policy on the BigQuery dataset to prevent accidental deletion.

Why wrong: Setting a retention policy on a BigQuery dataset only configures default table expiration; it does not prevent deletion. This step does not satisfy the requirement.

Use Cloud KMS to encrypt the data and destroy the key after 7 years.

Why wrong: Cloud KMS key destruction renders data unreadable but does not prevent the data itself from being deleted. It is not a valid step for preventing deletion.

Enable object lifecycle management to delete data after 7 years.

Why wrong: Enabling object lifecycle management to delete data after 7 years would cause the data to be deleted, which is the opposite of retaining it for 7 years.

Cloud Armor

Why wrong: Cloud Armor provides web application firewall (WAF) protection, not data content inspection or redaction.

VPC Service Controls

Why wrong: VPC Service Controls mitigate data exfiltration risks but do not inspect or redact content.

Security Command Center

Why wrong: Security Command Center provides threat detection and vulnerability scanning, not data redaction.

Increase the default audit log retention period in the Logging settings to 7 years.

Why wrong: Cloud Logging's default retention is 30 days for audit logs; it cannot be extended beyond that.

Enable Logging export to BigQuery and set table expiration to 7 years.

Why wrong: BigQuery table expiration would delete data, not retain it. Also, BigQuery is not the recommended long-term archival solution.

Use Cloud Functions to copy audit logs daily to Coldline Storage.

Why wrong: This is an overly complex workaround; a log sink directly to Cloud Storage is the standard approach.

Use Cloud Armor to inspect all traffic and block non-compliant requests.

Why wrong: Cloud Armor is a WAF; it does not provide network segmentation.

Enable Data Loss Prevention to scan payment data and restrict access.

Why wrong: DLP scans content but does not provide network isolation.

Deploy the CDE in a separate project and use IAM roles to restrict access.

Why wrong: Project separation alone does not provide network-level isolation; VPC Service Controls are needed for managed services.

IAM Conditions

Why wrong: IAM Conditions provide attribute-based access control, not restrictions on Google personnel.

VPC Service Controls

Why wrong: VPC Service Controls prevent data exfiltration but do not restrict Google personnel access.

Cloud HSM

Why wrong: Cloud HSM provides hardware security module for key management, not personnel access restrictions.

Lifecycle management rules

Why wrong: Lifecycle management rules are used for automating deletion or transition of objects, not for preventing modification or deletion.

Object versioning

Why wrong: Object versioning preserves previous versions of objects but does not prevent deletion or modification of the current version.

Object Retention Lock

Why wrong: Object Retention Lock is an AWS S3 feature, not available in Google Cloud Storage. It is not applicable to this GCP-based scenario.

Use Assured Workloads with EU Regions and Support and enable Access Transparency.

Why wrong: Assured Workloads can help but is not mandatory; DPA signing is the fundamental requirement.

Enable data encryption with CMEK and sign a DPA with Google.

Why wrong: While both are good practices, only signing the DPA addresses GDPR compliance; encryption alone is not sufficient for processing purpose limitations.

Enable VPC Service Controls and restrict data access to EU regions.

Why wrong: Data residency is important but does not fulfill the DPA or data subject rights requirements.

Penetration testing is allowed only for customers with Enterprise support plans.

Why wrong: No such restriction exists.

All penetration testing requires prior written approval from Google.

Why wrong: Google Cloud does not require prior approval for most penetration tests.

Testing must be limited to non-production environments only.

Why wrong: Google Cloud permits testing on production environments as long as it complies with the policy.

Use Cloud DLP to scan and redact the audit logs in place within BigQuery.

Why wrong: Cloud DLP cannot modify BigQuery audit logs directly; it can inspect and transform data in Cloud Storage or BigQuery tables but not system tables.

Use a DELETE statement on the audit logs table in BigQuery to remove the records.

Why wrong: Audit logs are stored in a read-only system table that cannot be directly modified.

Set a table expiration on the audit logs dataset to delete all logs after a short period.

Why wrong: This would delete all logs, not just the specific data subject's information, and may violate other compliance requirements.

PCI DSS

Why wrong: PCI DSS requires an Attestation of Compliance, not a BAA.

SOC 2

Why wrong: SOC reports are audit reports; no BAA is required.

FedRAMP

Why wrong: FedRAMP requires an Authorization to Operate (ATO), not a BAA.

Cloud Security Command Center

Why wrong: Security Command Center provides visibility and threat detection, not enforcement of compliance controls.

VPC Service Controls

Why wrong: VPC Service Controls provide data exfiltration protection but not the full set of FedRAMP controls.

Organization Policies

Why wrong: Organization policies can enforce location restrictions but do not provide Google personnel access controls.

Physical security of data centers

Why wrong: This is Google's responsibility.

Hardware maintenance

Why wrong: This is Google's responsibility.

Hypervisor security

Why wrong: This is Google's responsibility.

Use Cloud DLP to scan buckets and add retention policies automatically.

Why wrong: Cloud DLP does not manage bucket policies.

Use Security Command Center to find non-compliant buckets and manually apply retention policies.

Why wrong: This is not automated and does not prevent creation.

Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.

Why wrong: Audit logs can detect creation, but the setup is reactive; the recommended approach uses Organization policies to prevent creation without a policy.

Use SHA-1 for SSL certificates.

Why wrong: SHA-1 is deprecated and not allowed under PCI DSS.

Use default Google encryption keys (Google-managed) for data at rest.

Why wrong: Google-managed keys may not meet PCI DSS requirements for customer-managed key control; CMEK or EKM is typically required.

Use TLS 1.0 for data in transit.

Why wrong: TLS 1.0 is not considered secure and does not meet PCI DSS requirements.

VPC Service Controls automatically configured

Why wrong: VPC Service Controls are not automatically enforced; they are a complementary control that customers can configure.

Cloud Audit Logs retention set to 10 years

Why wrong: Audit log retention is not automatically set; customers must configure log sinks.

Enable Customer-Managed Encryption Keys (CMEK) for all services.

Why wrong: CMEK is optional; Google-managed encryption is acceptable under HIPAA.

Use Cloud Armor to protect the web application from DDoS attacks.

Why wrong: While a good practice, it is not specifically required by HIPAA.

Enable Audit Logs for all services that process PHI.

Why wrong: Audit logging is required but does not classify data.

Configure Cloud Armor to protect web applications handling PHI.

Why wrong: Cloud Armor provides WAF protection but does not classify data.

Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

Why wrong: VPC Service Controls help prevent data exfiltration but do not classify data.

Use Assured Workloads to automatically extend audit log retention to 7 years.

Why wrong: Assured Workloads enforces compliance controls but does not extend log retention beyond Logging's limits.

Create a log bucket with a retention period of 7 years using Log Analytics.

Why wrong: Log buckets have a maximum retention of 365 days; 7 years requires export to Cloud Storage.

Increase the retention period for Cloud Audit Logs in the Logs Router to 7 years.

Why wrong: Cloud Logging retains logs for a maximum of 365 days (log bucket retention). For longer retention, export is required.

Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

Why wrong: Exclusion filters cannot be applied retroactively and may not catch all PII.

Enable BigQuery table snapshot and restore to a point before the data was logged.

Why wrong: Snapshots do not help with targeted deletion of specific rows containing PII.

Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

Why wrong: Deleting the entire dataset is excessive and may remove non-personal data; also audit logs are immutable by default.