Task 5.1: Adhering to regulatory and industry standards requirements for the cloud.

• AAn Assured Workloads folder created with the control package that matches FedRAMP High

  Correct

  The control package applies location, personnel and service restrictions to every project in the folder and monitors for violations.

• BA folder with the resource locations constraint set to in:us-locations and nothing else

  Incorrect

  A location policy handles residency only; it does not restrict Google's support personnel or the services that can be used.

• CA VPC Service Controls perimeter around the agency's projects, with US IP ranges as access levels

  Incorrect

  A perimeter limits API access from outside it; it does not control data location, support personnel or service authorization.

• DCustomer-managed encryption keys from a US key ring for every service the agency uses

  Incorrect

  CMEK gives the contractor control of the keys that protect data at rest; it does not restrict Google's support personnel or which services can be used.

Assured Workloads applies a control package to a folder. Regulatory data boundary packages such as Data Boundary for FedRAMP High bundle data residency, personnel access controls and the list of supported products, enforced through organization policies and other features, and Assured Workloads monitors the folder for violations.

• AData Access audit logs for every service, with an alert to the bank officer on each read

  Incorrect

  Data Access logs record the bank's own principals; an alert after the fact is not an approval before access.

• BAccess Approval with the named officer as approver, alongside Access Transparency logs

  Correct

  Access Approval holds Google's access requests for the officer's decision, and Access Transparency, a default control for every organization, logs each access that follows.

• CAccess Transparency only, with the officer reviewing its logs after each access

  Incorrect

  Access Transparency records what Google personnel did, but only after the fact; nothing holds the access until the officer approves it.

• DKey Access Justifications on Cloud HSM keys, approving each decryption in the console

  Incorrect

  Key Access Justifications decides key use by justification code through a policy; it is not an officer approving each support request.

Access Transparency provides logs of actions taken by Google personnel on customer content, and Access Approval lets a customer require explicit approval before such access, within the supported services and stated exclusions. Access Transparency is a default security control for every organization, and Access Approval relies on it being enabled.

• ATurn on CMEK for every resource in the shared project, so that encrypted workloads fall out of scope

  Incorrect

  Encryption is a PCI requirement in its own right; it does not take systems that share the network and project with card data out of scope.

• BMove the whole project into an Assured Workloads folder so that Google takes over the PCI responsibilities

  Incorrect

  Google's PCI attestation covers its own infrastructure; the retailer stays responsible for its workloads under the shared responsibility model.

• CMove the payment service into its own projects and VPC network, and tightly limit what connects to it

  Correct

  Segmenting the cardholder data environment and tightly controlling connections leaves the other workloads out of scope, while systems that still connect to it stay in scope.

• DAdd firewall rules within the shared VPC network that log all traffic to the payment service's VMs

  Incorrect

  Logging traffic does not segment anything; every workload can still reach the payment service and stays in scope.

In PCI DSS, every system that stores, processes or transmits cardholder data, or that can connect to those systems, is in scope. Google's guidance for limiting scope is to isolate the cardholder data environment in its own projects and networks and to control and minimize what connects to it.

• ACreate an Assured Workloads folder, because Google signs a BAA only for Assured Workloads environments

  Incorrect

  The Google Cloud BAA covers Google's entire infrastructure; Assured Workloads packages are optional controls, not a condition of the BAA.

• BKeep all PHI in a single US region, because the BAA covers only one region per customer

  Incorrect

  The BAA covers all regions and zones, so multi-regional redundancy is allowed.

• CAsk Google to certify the startup's application as HIPAA compliant before launch

  Incorrect

  Google does not certify customers' applications; the customer remains responsible for evaluating its own HIPAA compliance.

• DReview and accept the Google Cloud BAA

  Correct

  Google's best practices start with entering into a Google Cloud BAA through the privacy compliance pages of the console.

• EKeep PHI out of services the BAA does not cover and out of pre-GA offerings

  Correct

  Google advises disabling unsupported services for PHI and not using pre-GA offerings with PHI.

Google Cloud supports HIPAA compliance within the scope of a Business Associate Agreement, which covers the entire infrastructure and a published list of products. The customer must decide whether it needs a BAA, accept it, keep PHI to covered GA products and configure its environment and applications correctly.

• AThe resource locations organization policy with in:eu-locations, which moves existing log buckets to the EU

  Incorrect

  A location policy affects where new resources can be created; it does not move log buckets, whose location cannot change after creation.

• BAn aggregated sink that copies every project's logs into an EU log bucket in a central project

  Incorrect

  A copy in the EU does not change where each project's own _Required and _Default buckets store the original entries.

• CA script that recreates the _Default bucket in the EU for each new project after it is created

  Incorrect

  The _Required bucket cannot be recreated or deleted, and logs are stored in the old location until the script runs.

• DDefault resource settings for Cloud Logging at the organization level, with an EU storage location

  Correct

  Organization or folder default settings set the storage location of the _Default and _Required buckets created for new projects.

Cloud Logging creates _Required and _Default buckets for each project, and their location cannot be changed after creation. Default resource settings for an organization or folder set the storage location, and optionally CMEK and the _Default sink behavior, for resources created afterwards, which is how residency requirements are met for logs.

• APatching the host operating system that runs the containers

  Incorrect

  Cloud Run's infrastructure, including the hosts and their operating systems, is managed by Google.

• BPhysical security of the data centers that host the service

  Incorrect

  Physical security is Google's responsibility for every Google Cloud service.

• CFixing vulnerable libraries in the container image it deploys

  Correct

  The application code, its dependencies and the image contents remain the customer's, as do IAM and data.

• DIsolating its containers from other customers' workloads on shared hosts

  Incorrect

  Cloud Run sandboxes each customer's code from the system and from other customers.

In the shared responsibility model, moving from IaaS to a managed platform shifts infrastructure duties to Google, but the customer keeps responsibility for its application, its dependencies, its data and its access configuration. Cloud Run, for example, sandboxes and runs the containers, while the images and their contents are the customer's.

• AFrom a Security Command Center compliance report for the organization

  Incorrect

  Security Command Center shows the customer's own posture against benchmarks; it does not issue Google's third-party audit reports.

• BBy opening a support case asking Google to audit the company's projects

  Incorrect

  Google does not audit customers' projects; the auditor needs Google's reports about its own controls.

• CFrom Access Transparency logs, which record Google's compliance with the controls

  Incorrect

  Access Transparency logs record Google personnel actions on customer data, not audit reports.

• DFrom Compliance Reports Manager, where Google Cloud publishes its audit reports and certificates

  Correct

  Compliance Reports Manager gives on-demand access to Google Cloud's ISO certificates, SOC reports and self assessments at no extra cost.

Under shared responsibility, the customer's assessment relies on evidence about the provider's controls. Google publishes its third-party audit reports and certificates, such as SOC reports and ISO/IEC certificates, through Compliance Reports Manager.

• AA quarterly manual review of every organization policy in the folder against the package documentation

  Incorrect

  A quarterly review leaves months between a change and its discovery.

• BAccess Approval on the folder, so that changes by administrators need approval

  Incorrect

  Access Approval governs Google personnel's access to data, not changes made by the customer's own administrators.

• CThe resource locations policy alone, because location is the only control the package monitors

  Incorrect

  Control packages cover far more than locations, and the location policy does not report on other changes.

• DAssured Workloads' built-in monitoring of the folder for violations of its control package

  Correct

  Assured Workloads compares the folder's organization policies with the package's requirements and reports a violation when they diverge.

Assured Workloads monitors its folders for compliance violations by comparing the organization policies and resources in a folder with the requirements of its control package. Violations are shown in the console and can be sent as notifications, so drift is caught soon after it happens.

• ACloud HSM keys in a European region, managed by the body's own staff

  Incorrect

  Cloud HSM keys are operated within Google Cloud; no local partner controls them.

• BA VPC Service Controls perimeter around the body's projects, with the local company as an access level

  Incorrect

  A perimeter controls API access; it does not hand key management or audit to a partner.

• CThe resource locations constraint with that country's locations only

  Incorrect

  Location rules handle residency but leave keys, justifications and audits with Google and the customer.

• DA Sovereign Controls by Partners control package in Assured Workloads

  Correct

  These packages are operated by local partners who manage keys, access justifications and audits, and they enforce data residency.

Assured Workloads offers control packages for regional and regulatory data boundaries and, through Sovereign Controls by Partners, packages operated by local trusted partners. Those partners manage encryption keys, access justification and audits, and the packages enforce data residency and the related security configurations.