Google Cloud Certified Professional-Cloud-Security-Engineer Book

To ensure compliance with strict regulatory requirements for storing and processing sensitive patient data in the cloud, the following measures should be implemented:​

Assured Workloads: Deploying an Assured Workloads environment in an approved region ensures that data residency requirements are met by restricting data storage and processing to specific geographic locations. Assured Workloads provide predefined controls and configurations tailored to meet regulatory compliance needs.​

Access Approval: Configuring Access Approval ensures that certain administrative actions on patient data require explicit approval from designated compliance officers. This adds a layer of control over sensitive operations, aligning with the need for explicit approvals.​

Cloud Audit Logs and Access Transparency: Enabling Cloud Audit Logs provides a detailed record of actions taken on your data, supporting the requirement for auditability. Access Transparency logs offer visibility into Google's administrative access to your content, enhancing transparency and compliance.​

Therefore, Option C is the most appropriate choice, as it comprehensively addresses data residency, administrative control, and auditability requirements.​

To migrate the current data backup and disaster recovery solutions to GCP while keeping the production environment on-premises, the most scalable and cost-efficient solution is using Google Cloud Storage with scheduled tasks and the gsutil command.

Setup Cloud Storage: Create a Cloud Storage bucket to store the backups.

Go to the Cloud Console and navigate to Cloud Storage.

Click "Create bucket" and follow the prompts to configure the storage bucket.

Install gsutil: Ensure gsutil is installed on the on-premises servers.

gsutil is a command-line tool for interacting with Cloud Storage.

Follow the installation guide here.

Create Backup Script: Write a script to upload data to Cloud Storage using gsutil.

#!/bin/bash gsutil -m cp -r /path/to/local/backup gs://your-bucket-name

Schedule Backup Task: Use a scheduling tool like cron on Linux to run the backup script at regular intervals.

Edit the crontab file with crontab -e and add an entry like:

Objective: Ensure that the analytics workload on Compute Engine instances accessing Cloud Storage does not interact with the public internet.

Solution:

Private Google Access: This allows Compute Engine instances that only have internal IP addresses to reach Google APIs and services through a private connection without the need for a public IP address.

No Public IP Addresses: By avoiding public IP addresses for the instances, you ensure that they are not accessible from the internet and do not initiate internet connections.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the VPC Network page and select the subnet where the Compute Engine instances are located.

Step 3: Enable Private Google Access for the subnet.

Step 4: Ensure that when launching the Compute Engine instances, no public IP addresses are assigned to them.