Supporting compliance requirements practice questions

Store logs in the _Required log bucket with a custom retention of 7 years.

Why wrong: The _Required log bucket has a maximum retention of 400 days and cannot be extended to 7 years.

Disable logging for non-critical resources to reduce log volume and retain only essential logs.

Why wrong: Disabling logs would violate compliance requirements for audit trails.

Use a log sink to export logs to BigQuery and set the table expiration to 7 years.

Why wrong: BigQuery is not cost-optimized for long-term archival; Cloud Storage is cheaper.

Use customer-supplied encryption keys (CSEK) and Cloud Audit Logs.

Why wrong: CSEK shifts key management to the customer and does not provide network-level controls.

Use Cloud HSM for key management and Cloud DLP to inspect data.

Why wrong: Cloud DLP is for classification and de-identification, not for access control perimeters.

Enable Access Transparency and use Organization Policies to restrict resource locations.

Why wrong: Access Transparency logs but does not enforce access controls.

Configure TLS for each service using a Cloud Load Balancing with SSL policies.

Why wrong: Cloud Load Balancing is for external traffic, not for pod-to-pod communication within the mesh.

Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

Why wrong: HTTPS is for external traffic; pods communicate internally over HTTP/gRPC.

Use VPC Network Peering to connect the clusters and rely on the internal network encryption.

Why wrong: VPC peering does not encrypt traffic; encryption must be applied at the application layer.

Create the Bigtable instance with multi-region placement in europe-west1 and europe-west4.

Why wrong: Multi-region placement includes multiple regions, but some may be outside the EU? Actually europe-west1 and europe-west4 are both in EU, but multi-region is not recommended for strict residency; single region is safer.

Create an instance in a dual-region configuration (e.g., europe-west1 and europe-west4) and use backup policies.

Why wrong: Dual-region is not a supported placement option for Bigtable; only single-region or multi-region are available.

Use a single-region instance in europe-west1 with customer-managed encryption keys (CMEK) for backups.

Why wrong: CMEK does not affect data residency; backups are still stored in the same region.

Disable automatic backups to prevent exposure of protected health information (PHI).

Why wrong: Backups are important for data durability; HIPAA does not require disabling them.

Implement VPC Service Controls to create a perimeter around the projects.

Why wrong: VPC Service Controls are a security best practice but not a HIPAA requirement.

Use customer-managed encryption keys (CMEK) for all services.

Why wrong: CMEK is optional; default Google-managed encryption meets HIPAA requirements.

Use Cloud KMS to encrypt individual columns containing personal data.

Why wrong: BigQuery does not support column-level encryption; Cloud DLP is used for de-identification.

Store data in a multi-region location like 'EU' to ensure availability across regions.

Why wrong: GDPR does not require multi-region; data can be stored in a single region.

The instance bypassed SSL enforcement because the database was configured to accept non-encrypted connections. You should enable the 'require SSL' flag.

Why wrong: SSL enforcement was already enabled; the connection was likely encrypted but still allowed due to VPC access.

The instance used the Cloud SQL Proxy, which bypasses network controls. You should remove the proxy and require direct connections over private IP.

Why wrong: Cloud SQL Proxy is a secure method for connecting; it does not bypass controls.

VPC Service Controls were not configured to block the connection. You should create a service perimeter to prevent data exfiltration.

Why wrong: VPC Service Controls do not block connections within the same VPC; they control data movement across perimeters.

VPC Service Controls are blocking the use of CMEK.

Why wrong: VPC Service Controls do not affect encryption settings.

The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.

Why wrong: CMEK keys can be used from any region as long as the key ring exists.

The buckets are using the Archive storage class, which does not support CMEK.

Why wrong: All storage classes support CMEK.

Use VPC Service Controls to restrict access to BigQuery datasets, and use IAM conditions to limit column access.

Why wrong: VPC Service Controls do not provide column-level encryption.

Use Cloud HSM to create encryption keys and apply them to BigQuery tables using Cloud Key Management Service.

Why wrong: Cloud HSM is used for key management, but column-level encryption requires CMEK with keys in Cloud KMS.

Use Cloud Data Loss Prevention to de-identify sensitive columns, and then use IAM to control access.

Why wrong: Data Loss Prevention de-identifies data, but does not provide encryption for querying.

Attach to the VPC network that hosts the load balancer.

Why wrong: Cloud Armor policies are not attached to VPC networks.

Configure as an Organization Policy constraint.

Why wrong: Organization Policy constraints do not control traffic at the network level.

Configure as a firewall rule in the VPC network.

Why wrong: Firewall rules do not support geographic blocking.

VPC Service Controls are blocking access to Secret Manager.

Why wrong: VPC Service Controls would produce a different error.

The service account does not have the iam.serviceAccounts.actAs permission on the Cloud Run service.

Why wrong: That permission is not required for Secret Manager access.

The secret does not exist in the specified project.

Why wrong: The error says 'Permission denied', not 'Not found'.

constraints/compute.restrictAuthorizedDomains

Why wrong: This restricts domains for Cloud Storage.

constraints/compute.trustedImageProjects

Why wrong: This is not a valid constraint name.

constraints/compute.restrictFirewallRules

Why wrong: This restricts firewall rule creation.

Enable Admin Activity audit logs for each individual project.

Why wrong: This would miss organization-level changes.

Enable System Event audit logs for the organization.

Why wrong: System Event logs are for GCP system events, not IAM changes.

Enable Data Access audit logs for the organization.

Why wrong: Data Access logs record data access, not admin changes.

Lifecycle rules with a Delete action.

Why wrong: Lifecycle rules delete objects, not prevent deletion.

Object versioning.

Why wrong: Versioning keeps multiple versions but does not prevent deletion.

Both instances

Why wrong: instance-1 has it.

Neither instance

Why wrong: instance-2 is missing it.

instance-1 only

Why wrong: instance-1 has compliance label.

Grant the roles/secretmanager.secretAccessor role to all service accounts in the project.

Why wrong: This violates least privilege.

Create a service account key for a dedicated service account, download it to the instance, and use it to access the secret.

Why wrong: Service account keys are long-lived and should be avoided.

Store the password in instance metadata and have the application read it from the metadata server.

Why wrong: Instance metadata is not as secure as Secret Manager.

Apply a retention policy to each object individually using object holds.

Why wrong: Object holds prevent deletion but are manual and not suitable for all objects; a bucket-level retention policy is preferred.

Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.

Why wrong: VPC Service Controls prevent data exfiltration but do not enforce data immutability or retention.

Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.

Why wrong: Lifecycle rules do not prevent manual deletion; objects could still be deleted before the retention period ends.

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Why wrong: VPC Service Controls prevent unauthorized access but do not log all access attempts.

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Why wrong: De-identification reduces risk but does not fulfill audit logging requirements.

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Why wrong: While HSM provides hardware security, it does not address audit logging.

Create a Cloud Function to export the data before deletion.

Why wrong: Export is not required and would keep data longer.

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Why wrong: Retention policy prevents deletion before expiration, not enforce deletion.

Use BigQuery continuous backups with a 30-day retention.

Why wrong: Continuous backups would increase storage costs unnecessarily.

Use VPC Service Controls to restrict access to the database instances.

Why wrong: VPC Service Controls are for accessing Google-managed services, not for Compute Engine instances.

Remove the firewall rule allowing all traffic from the public subnet to the private subnet, and rely on the default allow internal rule.

Why wrong: The default allow internal rule only applies to the same VPC and subnet, not across subnets.

Change the existing rule to allow traffic only on ports 3306 and 443 from the public subnet to the private subnet.

Why wrong: Allowing port 443 from the public subnet to the private subnet is unnecessary and still too permissive.