Answer-first summary for fast verification
Answer: Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts.
Option B is the correct answer because it provides comprehensive protection against data exfiltration for PII in Google Cloud. Cloud DLP (Data Loss Prevention) is specifically designed to identify and protect sensitive information like PII through scanning, redaction, and masking. VPC Service Controls (VPC SC) create security perimeters around Google Cloud services to prevent data exfiltration by restricting data access and movement. Option A focuses only on encryption and secure channels, which doesn't prevent authorized users from exfiltrating data they can access. Option C is overly restrictive by blocking all outbound traffic, which would break legitimate business functions. Option D is insufficient as it relies on human judgment rather than automated security controls. The community discussion shows 100% consensus on B with upvoted comments supporting this choice.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
Your organization is migrating a sensitive data processing workflow for customer Personally Identifiable Information (PII) from on-premises to Google Cloud. What security measures should you design to mitigate the risk of data exfiltration in the cloud environment?
A
Encrypt all sensitive data in transit and at rest. Establish secure communication channels by using TLS and HTTPS protocols.
B
Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts.
C
Restrict all outbound network traffic from cloud resources. Implement rigorous access controls and logging for all sensitive data and the systems that process the data.
D
Rely on employee expertise to prevent accidental data exfiltration incidents.
No comments yet.