An organization is preparing for a PCI-DSS compliance audit of its cloud workloads. The security team discovers that cardholder data, including Primary Account Numbers (PAN), is mixed with non-regulated operational data across multiple BigQuery datasets and Compute Engine workloads. To reduce the compliance audit footprint and establish a secure Cardholder Data Environment (CDE), the organization must: Automatically identify, classify, and catalog all sensitive cardholder data assets. Isolate regulated storage and processing workloads from non-regulated systems at both the resource hierarchy and API/network perimeter levels. Enforce fine-grained access controls on sensitive data fields. Which strategy should the security engineer implement to achieve these objectives?

Use Sensitive Data Protection (Cloud DLP) to discover and classify PAN data, tag assets in Data Catalog, migrate regulated workloads into dedicated projects inside a segregated folder, and enclose them within a VPC Service Controls service perimeter while applying BigQuery policy tags for column-level access.: ### What the Solution Is This architecture combines automated sensitive data discovery, organizational segregation, network perimeter enforcement, and fine-grained data governance to cleanly isolate and minimize the **Cardholder Data Environment (CDE)** scope under **PCI-DSS**. ### How It Meets the Requirements - **Discover and catalog regulated data:** **Sensitive Data Protection (Cloud DLP)** inspects structured and unstructured data in BigQuery and Cloud Storage to detect `CREDIT_CARD_NUMBER` / PAN infoTypes. Integrating this with **Data Catalog** automatically applies business metadata tags and sensitivity classifications to datasets, tables, and columns. - **Isolate regulated workloads and reduce audit footprint:** Placing regulated workloads and storage inside dedicated Google Cloud projects within a specific folder hierarchy physically and logically separates CDE assets from non-scoped corporate resources. - **Enforce network and API boundary isolation:** Enclosing these dedicated projects within a **VPC Service Controls** service perimeter restricts API-level data egress and ingress. This prevents unauthorized movement of cardholder data to unauthorized projects or outside environments, strictly delineating the CDE boundary for Qualified Security Assessors (QSAs). - **Fine-grained column-level access control:** Implementing **BigQuery policy tags** linked to Data Catalog taxonomies restricts visibility of specific cardholder fields (such as PAN) to authorized personas through granular IAM roles. ### Key Advantages - **Reduced Audit Scope:** Clearly isolated project perimeters minimize the number of systems, networks, and personnel that fall under PCI-DSS assessment scope. - **Automated Governance:** Continuous DLP discovery and Data Catalog metadata synchronization eliminate manual classification errors. - **Exfiltration Mitigation:** VPC Service Controls blocks perimeter bridging and unauthorized API data exfiltration even if IAM credentials are leaked. - **Defense in Depth:** Combines IAM role bindings, column-level security tags, and API network boundaries. ### Why This Is Optimal This solution directly satisfies the principle of least scope by separating regulated assets into dedicated container projects, applying strict perimeter isolation using VPC Service Controls, and cataloging all cardholder data automatically.

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc | Professional Cloud Security Engineer

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is preparing for a PCI-DSS compliance audit of its cloud workloads. The security team discovers that cardholder data, including Primary Account Numbers (PAN), is mixed with non-regulated operational data across multiple BigQuery datasets and Compute Engine workloads.

To reduce the compliance audit footprint and establish a secure Cardholder Data Environment (CDE), the organization must:

Automatically identify, classify, and catalog all sensitive cardholder data assets.
Isolate regulated storage and processing workloads from non-regulated systems at both the resource hierarchy and API/network perimeter levels.
Enforce fine-grained access controls on sensitive data fields.

Which strategy should the security engineer implement to achieve these objectives?

Use Sensitive Data Protection (Cloud DLP) to discover and classify PAN data, tag assets in Data Catalog, migrate regulated workloads into dedicated projects inside a segregated folder, and enclose them within a VPC Service Controls service perimeter while applying BigQuery policy tags for column-level access.

Configure Organization Policy constraints to restrict resource deployment to US regions, configure Cloud NAT on all VPC subnets, and set immutable retention periods using Cloud Storage Bucket Lock on all data exports.

Maintain all data in the existing shared projects, apply dataset-level IAM viewer permissions, establish VPC Network Peering between subnets, and configure Cloud Armor edge security policies on incoming traffic.

Deploy Web Security Scanner across Compute Engine workloads, connect all project VPCs using Cloud VPN with IPsec encryption, and enforce multi-factor authentication via Cloud Identity.

Professional Cloud Security Engineer

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc

Related questions