4 of the 6 questions we have for this objective, shown with the answer and the reasoning.
Designing for compliance
Mercer Clinics, a US healthcare provider, plans to move a patient scheduling system that stores protected health information (PHI) to Google Cloud using Cloud SQL, Cloud Run, and Cloud Storage. The compliance officer asks what must be in place before any PHI is loaded so that the company meets its HIPAA obligations when using a cloud provider.
What should you do first?
- AAccept the Google Cloud Business Associate Agreement for the account and confirm that every service used is listed as covered by itHIPAA requires a BAA with a business associate that handles PHI, and Google's BAA applies only to the services it lists, so both steps must come before PHI is stored.
- BEnable CMEK on every service that will hold PHIEncryption with customer keys is a good safeguard but HIPAA does not require CMEK, and it does not replace the required BAA.
- CRequest Google's HIPAA certification from Compliance Reports ManagerThere is no official government HIPAA certification for cloud providers; the contractual BAA and the customer's own safeguards are what HIPAA relies on.
- DPlace the projects in an Assured Workloads folder for FedRAMP HighFedRAMP is a US federal authorization program and is not the mechanism for HIPAA compliance by a private healthcare provider.
Why: Health record privacy laws such as HIPAA require a contract that obliges the cloud provider, as a business associate, to protect PHI. On Google Cloud this is the Business Associate Agreement, which covers a defined list of services, so architects must check each product against that list. After that, the customer still owns its safeguards under the shared responsibility model, such as access control, audit logging, and encryption choices. The distractors are useful controls or unrelated regimes that are often confused with the contractual requirement.
Designing for compliance
Kestrel Pharma stores clinical trial files in Cloud Storage buckets in a project named ks-trials. An internal investigation needs to know which users read specific objects last month, but the Logs Explorer shows only bucket creation and IAM policy changes for that project. The compliance team wants every future object read in ks-trials to be recorded.
What should you do?
- AEnable Data Access audit logs of type DATA_READ for Cloud Storage in the ks-trials audit configurationData Access audit logs are disabled by default for most services, including Cloud Storage; enabling DATA_READ records who read objects from then on.
- BEnable VPC Flow Logs on the subnets in ks-trialsVPC Flow Logs record network flows of VM interfaces, not API reads of Cloud Storage objects by identity.
- CTurn on Object Versioning for the bucketsVersioning keeps prior object versions after overwrite or deletion but records nothing about who read an object.
- DCreate a log sink for Admin Activity logs to BigQueryAdmin Activity logs cover configuration changes and are already on; exporting them does not add records of object reads.
Why: Cloud Audit Logs has four types: Admin Activity and System Event logs are always written and free, Policy Denied logs record VPC Service Controls and similar denials, and Data Access logs record reads and writes of user data. Data Access logs are off by default for most services because they can be very large, with BigQuery as a notable exception, so an architect must enable them deliberately where audits need them. The missing past entries cannot be recovered, which is why audit requirements should be designed in at the start. Network logs and versioning are unrelated to identity-level reads.
Designing for compliance
Orrin Capital has an organization with about 200 projects across several folders. Regulators require that all audit logs from every current and future project are kept for seven years in a central location, that no one, including administrators, can shorten the retention or delete the logs early, and that the solution needs as little ongoing maintenance as possible.
Which two actions should you take? Each correct answer presents part of the solution.
- ACreate an aggregated sink at the organization node with child resources included and a filter for audit log names, routed to a log bucket in a central logging projectAn aggregated sink at the organization collects matching logs from every folder and project beneath it, including projects created later, with a single configuration.
- BConfigure the central log bucket with a seven-year retention period and lock the bucketA locked log bucket cannot have its retention reduced or be deleted until entries age out, which meets the immutability requirement.
- CCreate a project-level sink in each project that routes audit logs to the central bucketPer-project sinks must be created for every new project and can be removed by project owners, which adds maintenance and leaves gaps.
- DRoute the logs to a BigQuery dataset and set a seven-year default table expirationTable expiration controls when data is deleted, but administrators can still change the setting or delete tables, so it is not immutable.
- EGrant the Logs Viewer role to the auditors on the organization nodeRead access helps auditors but does nothing to collect logs centrally or prevent deletion.
Why: Centralized, tamper-resistant audit logging on Google Cloud combines two features. Aggregated sinks at the organization or folder level route logs from all child resources, so coverage does not depend on per-project setup. Log buckets with a locked retention policy make the retention period irreversible, and Cloud Storage with a locked retention policy is the alternative when logs must be archived as objects. The distractors either require per-project maintenance or rely on settings that an administrator can change.
Designing for compliance
Sutton Fintech is completing a vendor risk questionnaire for a bank customer. The bank asks for Google Cloud's most recent SOC 2 Type II report to confirm controls on the infrastructure that hosts Sutton's application. Sutton's compliance officer wants to obtain the official report directly from Google.
Where should the compliance officer get the report?
- AFrom the Security Command Center compliance dashboard in the Sutton organizationSecurity Command Center reports on how Sutton's own resources align with benchmarks; it does not provide Google's third-party audit reports.
- BBy filing a technical support case and asking for a copySupport is not the distribution channel for audit reports when a self-service portal exists, and this adds delay.
- CFrom Compliance Reports Manager in the Google Cloud console or the compliance resource centerCompliance Reports Manager provides on-demand downloads of Google Cloud's certifications and audit reports, including SOC 2, for customers.
- DFrom the Assured Workloads monitoring pageAssured Workloads monitors your folder for configuration violations; it does not host Google's audit reports.
Why: Under the shared responsibility model, Google is audited by independent third parties for the infrastructure and services it operates, and customers inherit those attestations for their own audits. Compliance Reports Manager gives customers self-service access to reports such as SOC 1, SOC 2, ISO/IEC 27001, and PCI DSS attestations. Customers remain responsible for the controls they configure, which is where Security Command Center and Assured Workloads help. The distractors are real compliance tools that answer the customer-side half of the model.