ExpertThis question is part of a case study — click to read the full scenario(Case 11)
CASE STUDY: HealthData Inc
Overview:
Industry: Healthcare Analytics
Size: 1000 employees
Environment:
- Co-located data center
- Hadoop cluster
- SFTP servers
- 50 TB patient data
Requirements:
- ML models for diagnostics
- Secure data sharing portals
- Break data silos
Exec Statements:
- CEO: Need compute for ML.
- CRO: HIPAA compliance is top priority.
- CTO: Managed services needed to replace Hadoop.
Tech Reqs:
- Strict HIPAA compliance
- Automated PHI de-identification
- Comprehensive audit logging
- CMEK
- Network isolation (no public internet)
Constraints:
- US data sovereignty
- 7-year retention (immutable)
- Easy auditor access
QUESTION: To replace the on-premises Hadoop cluster with a managed service while minimizing migration effort, which GCP service should you recommend?
GCP PCA · Question 12 · Security Design
CASE STUDY: HealthData Inc
Overview:
Industry: Healthcare Analytics
Size: 1000 employees
Environment:
- Co-located data center
- Hadoop cluster
- SFTP servers
- 50 TB patient data
Requirements:
- ML models for diagnostics
- Secure data sharing portals
- Break data silos
Exec Statements:
- CEO: Need compute for ML.
- CRO: HIPAA compliance is top priority.
- CTO: Managed services needed to replace Hadoop.
Tech Reqs:
- Strict HIPAA compliance
- Automated PHI de-identification
- Comprehensive audit logging
- CMEK
- Network isolation (no public internet)
Constraints:
- US data sovereignty
- 7-year retention (immutable)
- Easy auditor access
QUESTION: How should you enforce the network isolation requirement to ensure that patient data in Cloud Storage and BigQuery cannot be accessed from the public internet?
CASE STUDY: HealthData Inc
Overview:
Industry: Healthcare Analytics
Size: 1000 employees
Environment:
- Co-located data center
- Hadoop cluster
- SFTP servers
- 50 TB patient data
Requirements:
- ML models for diagnostics
- Secure data sharing portals
- Break data silos
Exec Statements:
- CEO: Need compute for ML.
- CRO: HIPAA compliance is top priority.
- CTO: Managed services needed to replace Hadoop.
Tech Reqs:
- Strict HIPAA compliance
- Automated PHI de-identification
- Comprehensive audit logging
- CMEK
- Network isolation (no public internet)
Constraints:
- US data sovereignty
- 7-year retention (immutable)
- Easy auditor access
QUESTION: How should you enforce the network isolation requirement to ensure that patient data in Cloud Storage and BigQuery cannot be accessed from the public internet?
Answer options:
Configure Identity-Aware Proxy (IAP) for all Cloud Storage buckets.
Remove all IAM roles containing 'roles/storage.objectViewer' from external users.
Implement VPC Service Controls to create a secure perimeter around the GCP projects.
Use Cloud Armor to block all external IP addresses.
How to approach this question
Full Answer
Common mistakes
Practice the full GCP Professional Cloud Architect Practice Exam 6
50 questions · hints · full answers · grading