An enterprise financial organization is preparing for an upcoming regulatory audit. The external compliance auditors have requested formal evidence of the underlying cloud provider's security posture, specifically requiring: Current independent third-party audit reports (such as SOC 2 Type II) Industry compliance certifications (such as ISO/IEC 27001 and ISO/IEC 27017) Bridge letters (letters of attestation) covering recent operational periods Which Google Cloud resource should the cloud architect leverage to acquire these third-party compliance reports and attestation letters?

Access Google Cloud Artifact / Compliance Reports Manager via the Compliance Resource Center to download third-party audit reports, certifications, and bridge letters directly under NDA: ### What Google Cloud Artifact / Compliance Resource Center is **Google Cloud Artifact** (and the **Compliance Reports Manager** within the **Compliance Resource Center**) is Google Cloud's centralized portal for customers to access and download security and compliance documentation. It provides direct, self-service access to **third-party audit reports**, **certifications**, **letters of attestation**, and **bridge letters** that validate Google Cloud's shared responsibility posture. ### How it meets the requirements - **Independent audit reports**: Provides direct access to complete **SOC 1**, **SOC 2 Type II**, and **SOC 3** reports compiled by independent external audit firms. - **Industry certifications**: Hosts downloadable compliance certifications and assessment summaries for global standards like **ISO/IEC 27001**, **ISO/IEC 27017**, **ISO/IEC 27018**, and **PCI DSS**. - **Bridge letters**: Supplies formal **letters of attestation** and bridge letters covering interim periods between audit cycles to ensure continuous compliance verification for regulators and stakeholders. ### Key capabilities - **Self-service retrieval**: Enables authorized administrators and compliance teams to retrieve sensitive audit documentation on demand. - **Confidential report access**: Manages Non-Disclosure Agreements (NDAs) and role-based access directly within the portal for confidential auditor packages. - **Up-to-date compliance repository**: Maintains current and historical audit artifacts covering Google Cloud's physical infrastructure, data centers, and managed services. - **Stakeholder and auditor enablement**: Satisfies regulatory verification requirements by presenting independent auditor evaluations of Google's technical and physical controls. ### Why this is optimal Under the cloud **shared responsibility model**, customers inherit Google Cloud's baseline security controls. To satisfy regulatory auditors regarding infrastructure controls that customers do not manage directly, organizations must present Google's independent third-party audit reports and attestations obtained through the Compliance Resource Center.

StudyCerts

Acquire Compliance Reports Bridge Letters Artifact | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Acquire Compliance Reports Bridge Letters Artifact

Section: Industry certifications (e.g., SOC 2)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise financial organization is preparing for an upcoming regulatory audit. The external compliance auditors have requested formal evidence of the underlying cloud provider's security posture, specifically requiring:

Current independent third-party audit reports (such as SOC 2 Type II)
Industry compliance certifications (such as ISO/IEC 27001 and ISO/IEC 27017)
Bridge letters (letters of attestation) covering recent operational periods

Which Google Cloud resource should the cloud architect leverage to acquire these third-party compliance reports and attestation letters?

Query Cloud Audit Logs in Cloud Logging to extract administrator data access and system event entries for the audit period

Configure Security Command Center to export vulnerability findings and compliance posture scores directly to the auditors

Deploy Artifact Registry to store and sign container images with Binary Authorization attestations

Access Google Cloud Artifact / Compliance Reports Manager via the Compliance Resource Center to download third-party audit reports, certifications, and bridge letters directly under NDA

Professional Cloud Architect

Acquire Compliance Reports Bridge Letters Artifact

Related questions