An organization is preparing for a PCI-DSS compliance audit of its cloud workloads. The security team discovers that cardholder data, including Primary Account Numbers (PAN), is mixed with non-regulated operational data across multiple BigQuery datasets and Compute Engine workloads. To reduce the compliance audit footprint and establish a secure Cardholder Data Environment (CDE), the organization must: Automatically identify, classify, and catalog all sensitive cardholder data assets. Isolate regulated storage and processing workloads from non-regulated systems at both the resource hierarchy and API/network perimeter levels. Enforce fine-grained access controls on sensitive data fields. Which strategy should the security engineer implement to achieve these objectives?

Use Sensitive Data Protection (Cloud DLP) to discover and classify PAN data, tag assets in Data Catalog, migrate regulated workloads into dedicated projects inside a segregated folder, and enclose them within a VPC Service Controls service perimeter while applying BigQuery policy tags for column-level access.: What the Solution Is This architecture combines automated sensitive data discovery, organizational segregation, network perimeter enforcement, and fine-grained data governance to cleanly isolate and minimize the Cardholder Data Environment (CDE) scope under PCI-DSS. How It Meets the Requirements Discover and catalog regulated data: Sensitive Data Protection (Cloud DLP) inspects structured and unstructured data in BigQuery and Cloud Storage to detect CREDIT_CARD_NUMBER / PAN infoTypes. Integrating this with Data Catalog automatically applies business metadata tags and sensitivity classifications to datasets, tables, and columns. Isolate regulated workloads and reduce audit footprint: Placing regulated workloads and storage inside dedicated Google Cloud projects within a specific folder hierarchy physically and logically separates CDE assets from non-scoped corporate resources. Enforce network and API boundary isolation: Enclosing these dedicated projects within a VPC Service Controls service perimeter restricts API-level data egress and ingress. This prevents unauthorized movement of cardholder data to unauthorized projects or outside environments, strictly delineating the CDE boundary for Qualified Security Assessors (QSAs). Fine-grained column-level access control: Implementing BigQuery policy tags linked to Data Catalog taxonomies restricts visibility of specific cardholder fields (such as PAN) to authorized personas through granular IAM roles. Key Advantages Reduced Audit Scope: Clearly isolated project perimeters minimize the number of systems, networks, and personnel that fall under PCI-DSS assessment scope. Automated Governance: Continuous DLP discovery and Data Catalog metadata synchronization eliminate manual classification errors. Exfiltration Mitigation: VPC Service Controls blocks perimeter bridging and unauthorized API data exfiltration even if IAM credentials are leaked. Defense in Depth: Combines IAM role bindings, column-level security tags, and API network boundaries. Why This Is Optimal This solution directly satisfies the principle of least scope by separating regulated assets into dedicated container projects, applying strict perimeter isolation using VPC Service Controls, and cataloging all cardholder data automatically.

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An organization is migrating its financial transaction processing workloads to Google Cloud and preparing for an upcoming PCI DSS and SOC 2 Type II compliance audit. The target environment includes: Compute Engine instances (IaaS) running custom transaction processing applications Cloud SQL for PostgreSQL (PaaS) storing encrypted customer account records Google Workspace (SaaS) used by compliance analysts to review audit summaries To establish the compliance boundaries and satisfy auditor requirements, which approach correctly maps the shared responsibility model across these service tiers and identifies the appropriate compliance artifact retrieval process?

Determining the Google Cloud environment in scope for regulatory compliance.

AdvancedProfessional Cloud Security Engineer

A financial services organization must implement a centralized log export architecture across all Google Cloud resources to comply with strict regulatory frameworks. The compliance and security requirements are: Comprehensive Audit Coverage: All audit logs from existing and future folders and projects across the organization must be captured automatically. Data Residency: Log archives must strictly reside in a designated geographic region (europe-west3). Tamper Resistance & Least Privilege: The log delivery mechanism must be restricted to write-only permissions on the destination archive to prevent exfiltration, modification, or deletion, while project administrators in child projects must have no access to alter or delete centralized logs. Which log export and IAM configuration should the security team implement?

Configuring log exports (log sinks and aggregated sinks).

AdvancedProfessional Cloud Security Engineer

An enterprise organization manages a Google Cloud resource hierarchy consisting of an Organization node, several environment folders (Production, Staging, Development), and dozens of child projects. The security team wants to implement tag-based access control (TBAC) with IAM Conditions to grant the Cloud Operations team (cloud-ops@example.com) administrative permissions across virtual machines under the following requirements: The Cloud Operations team must be granted roles/compute.admin dynamically only on resources evaluated with the environment: production tag value. A safe default configuration must be applied so that all newly created and existing resources across the organization inherit a non-production tag state unless explicitly set. Projects under the Production folder must automatically inherit production tag enforcement without requiring per-project configuration, while allowing descendant resources to override the tag value when necessary. The IAM condition must minimize security risks associated with potential deletion and recreation of tag keys or values with identical names. Which strategy should the security engineer implement?

Using the resource hierarchy for access control and permissions inheritance.

AdvancedProfessional Cloud Security Engineer

An enterprise is eliminating long-lived service account keys across its development and CI/CD pipelines. A developer needs to invoke a private microservice deployed on Cloud Run (https://orders.example.com) directly from their local environment. The security requirements are: The authentication flow must use short-lived OpenID Connect (OIDC) ID tokens targeted specifically to the service URL. Access must follow the principle of least privilege by impersonating a dedicated privilege-bearing service account (order-invoker@corp-project.iam.gserviceaccount.com), which already possesses the Cloud Run Invoker role (roles/run.invoker). The solution must avoid granting broad token generation permissions or allowing credential persistence. Which IAM role and short-lived credential generation process should the security engineer implement?

Managing service account impersonation.

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a multi-tier perimeter security architecture in Google Cloud for containerized workloads hosted on Compute Engine VMs, alongside a dedicated virtual security appliance. The deployment must satisfy the following networking and boundary requirements: Due to RFC 1918 address space exhaustion on-premises, custom VPC subnets must utilize alternative valid private address ranges, such as RFC 6598 (100.64.0.0/10), without violating Google Cloud subnet allocation rules. Individual containers running on each host VM must each receive their own dedicated, internally routable IP address from a secondary subnet range for granular firewall policy enforcement without adding physical network interfaces. The virtual security appliance VM must connect directly to two distinct VPC networks (vpc-untrusted and vpc-trusted) to inspect and filter transit traffic between them. Which configuration should the enterprise implement to satisfy these requirements?

Differentiating between private and public IP addressing.

FundamentalAssociate Data Practitioner

Backup and DR Service

Compare backup and recovery solutions offered as Google-managed services

Professional Cloud Security Engineer

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc

Related questions

Backup and DR Service

Professional Cloud Security Engineer

Isolate Cde Minimize Compliance Scope Dlp Vpc Sc

What the Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

Backup and DR Service

What the Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal