Task 3.2: Designing for compliance.

• AReview and accept Google's Business Associate Agreement for the account

  Correct

  Google supports HIPAA compliance within the scope of a Business Associate Agreement, which the customer reviews and accepts.

• BTreat Google's SOC 2 report as proof that the workload is compliant

  Incorrect

  A SOC 2 report describes Google's controls; the startup remains responsible for its own HIPAA compliance.

• CKeep PHI in the Google Cloud services that the agreement covers

  Correct

  The BAA covers specific products; PHI belongs only in those, configured by the customer.

• DEnable customer-managed encryption keys, which makes services compliant

  Incorrect

  CMEK changes who controls keys; it does not put a product under the BAA.

• EKeep PHI in United States regions, which HIPAA requires of clouds

  Incorrect

  HIPAA does not mandate a data location, and choosing a region alone does not satisfy it.

HIPAA on Google Cloud is shared responsibility: Google signs a BAA and protects its infrastructure, while the customer limits PHI to covered products and configures them correctly.

• AA VPC Service Controls perimeter around every project that holds the driver data

  Incorrect

  A perimeter controls which services and networks can reach the data, not the region where resources are created.

• BAn organization policy on the folder restricting resource locations to the EU

  Correct

  The resource locations constraint, set with an EU value group, stops location-based resources from being created outside the allowed locations.

• CLabels recording each resource's region, checked in a weekly compliance report

  Incorrect

  Labels and reports detect violations after the fact; they do not prevent them.

• DCloud KMS keys created in an EU key ring and used to encrypt the driver data

  Incorrect

  A key's location does not stop teams from creating storage or compute in other regions.

Data residency is enforced preventively with the resource locations organization policy, applied at the folder that holds the regulated projects.

• AINFORMATION_SCHEMA queries that list every table's column names and types

  Incorrect

  Column metadata cannot reveal card numbers hidden in a free-text notes column.

• BData Access audit logs for the BigQuery datasets, routed to a log bucket

  Incorrect

  Audit logs describe API activity on the datasets; they do not inspect the values stored in the tables.

• CCloud Asset Inventory searches that list the BigQuery tables in the organization

  Incorrect

  Asset Inventory lists the tables but does not inspect their contents.

• DSensitive Data Protection discovery of BigQuery data across the organization

  Correct

  The discovery service continuously profiles BigQuery tables and columns and classifies the sensitive data types, such as card numbers, that they contain.

Handling commercial sensitive data such as card numbers starts with knowing where it is. Sensitive Data Protection discovery profiles data continuously, so new tables are covered too.

• AAccess Transparency logs

  Correct

  Access Transparency provides logs of actions taken by Google personnel when they access customer content.

• BData Access audit logs

  Incorrect

  Data Access logs record what the bank's own principals read and write, not Google personnel access.

• CAccess Approval requests

  Correct

  Access Approval lets the customer approve or deny Google personnel access requests before they happen.

• DVPC Service Controls

  Incorrect

  A service perimeter limits data movement by API; it does not record or approve Google support access.

• ECustomer-managed keys

  Incorrect

  CMEK gives control over encryption keys, but on its own it neither logs nor approves personnel access.

Regulated customers often need oversight of the cloud provider's own staff. Access Transparency gives visibility and Access Approval gives control over Google personnel access.

• AAn aggregated sink at the organization that routes audit logs to a central destination

  Correct

  An aggregated sink at the organization collects matching logs from all child resources, including new projects, and is configured above the project level.

• BA sink in each project that each project owner creates and maintains for the security team

  Incorrect

  Per-project sinks miss new projects and can be changed or deleted by each project's owner.

• CThe _Required bucket in each project, searched one project at a time when needed

  Incorrect

  The _Required bucket holds some audit log types, such as Admin Activity, for 400 days, separately in each of the 300 projects; Data Access logs are not even stored there.

• DData Access audit logs enabled in each project, with the logs left where they are

  Incorrect

  Enabling more logs does not bring them together in one place for the security team.

Audits need complete, central log evidence. Aggregated sinks at the organization or folder level route logs from every child project, beyond the reach of project owners.

• ACloud SQL tables designed separately for each new provider

  Incorrect

  A schema per provider means custom parsing of each standard and slows provider onboarding.

• BBigtable tables keyed by provider and message ID

  Incorrect

  Bigtable stores rows at scale but knows nothing about FHIR resources or HL7v2 messages.

• CPub/Sub topics that hold every provider message

  Incorrect

  Pub/Sub moves messages but is not a store that parses and serves health data standards.

• DThe Cloud Healthcare API with FHIR and HL7v2 stores

  Correct

  The Cloud Healthcare API provides managed FHIR, HL7v2 and DICOM stores that implement healthcare data standards.

Health record privacy rules and interoperability standards go together. A managed service built for FHIR and HL7v2 handles the formats while running on Google Cloud's compliance foundations.

• AA resource locations organization policy on the contractor's project

  Incorrect

  A single organization policy does not cover the personnel and other controls the regime requires.

• BAn Assured Workloads folder with the matching control package

  Correct

  Assured Workloads applies predefined control packages to a folder, enforcing data residency, personnel access and other regulatory controls.

• CA VPC Service Controls perimeter around the project

  Incorrect

  A perimeter limits data movement but does not provide the regime's full set of controls.

• DCustomer-managed encryption keys for every service

  Incorrect

  Encryption keys are one control among many and do not restrict support personnel.

Industry and government regimes bundle many controls. Assured Workloads packages them so a regulated environment is compliant by construction.