Government regulations in the banking industry mandate the protection of clients' personally identifiable information (PII). Your company requires PII to be access controlled, encrypted, and compliant

Question

Options

• AAssign the required identity and Access Management (IAM) roles to every employee, and create a single service account to access protect resources
• BUse one service account to access a Cloud SQL database and use separate service accounts for each human user
• CUse Cloud Storage to comply with major data protection standards.
• DUse Cloud Storage to comply with major data protection standards.

• A
  9% (4)
• B
  13% (6)
• C
  4% (2)
• D
  74% (35)

Explanation

Note: Options C and D are identical in this question - this appears to be a formatting/copy error in the exam material. The intended correct answer for D was likely something about creating separate, least-privilege service accounts per workload (a common Google Cloud best-practice answer), not "Use Cloud Storage." The explanation below addresses the underlying concepts as intended.

Why the Google-recommended approach centers on least-privilege service accounts: Google recommends creating dedicated, narrowly scoped service accounts for each application or service that touches PII - not one shared account - so a breach of one account doesn't expose all protected resources. Service accounts should carry only the IAM roles needed for their specific function.

Why A is wrong: Assigning IAM roles directly to every employee and using a single service account violates least privilege. One compromised service account gives broad access to all PII.

Why B is wrong: Service accounts are for non-human workloads (applications, VMs, Cloud Functions). Human users should authenticate with their own identities (e.g., via Google Workspace), not through service accounts - mixing the two undermines auditability and violates Google's recommendations.

Why C is wrong (as a distractor): Simply using Cloud Storage addresses storage, not access control with service accounts - it doesn't answer the question's requirement.

Memory tip: Think "one service account per job, not per person" - service accounts belong to workloads, humans belong to IAM groups, and the principle of least privilege applies to both.

No community discussion yet for this question.