Google Cloud Digital Leader: Threat Defense and Data Sovereignty

Match a threat or regulatory requirement to a control, its configuration, and evidence; distinguish posture monitoring and prompt screening from automatic compliance.

Objective: match the control to the question

Using IAM and encryption as separate controls, build a requirement-to-evidence chain for a security or compliance decision. The chain names the risk or obligation, the relevant control, the person configuring it, and the evidence that it works for the workload. A list of security products is not this chain. A control that helps detect exposed resources solves a different problem from a rule that limits who can approve a transaction. Begin with the stated failure or requirement before proposing a service.

Findings support investigation and response

Security Command Center provides risk-management tools for areas including vulnerabilities, threats, security posture, and compliance frameworks. Its services can generate findings about issues such as misconfigurations or exposed resources. The team must still understand the finding, its scope, and the appropriate response. Service tiers and activation affect available capabilities, so do not assume every deployment automatically has every advertised feature. An empty findings view is also not proof that all risks have been examined; inspect what was actually configured and monitored.

AI screening has a specific scope

Model Armor screens supported risks in model prompts and responses. Configurable filters and thresholds can help with threats such as prompt injection and sensitive-content exposure. A screening result does not establish that a business answer is factually correct, that a transaction is authorized, or that a legal requirement is satisfied. Treat it as one layer in an AI workflow alongside access control, task evaluation, and appropriate human oversight. Distinguishing these layers makes it possible to test each failure rather than expecting one tool to prove every property.

Worked example

Fictional case: a membership organization must keep selected records within an approved geography and restrict them to an authorized team. First ask its accountable legal and security owners to specify the applicable requirement and data scope; do not infer a universal rule from a country name. Second check the chosen services’ actual location and processing behavior against that requirement. Third configure and test access controls, including inherited grants. Fourth retain relevant provider and customer-control evidence. The provider’s compliance offerings and regional options can support the design, but selecting a region is not a complete workload-compliance assessment.

Change one requirement and expose the gap

Now an AI support assistant is added and can send record extracts to a model. The original storage-location decision does not establish the processing location or data handling of this new path. Reassess the additional service, the permitted data, permissions, and the applicable contractual or regulatory conditions. Screening sensitive content can help reduce a supported risk, yet it cannot replace the organization’s decision about whether that processing is allowed. This is why sovereignty and compliance need a workload-wide view rather than an isolated storage checkbox.

Transfer check

A team claims its application is compliant because Security Command Center is enabled and its chosen provider has a relevant certification. What is missing? Check: the workload’s applicable requirements, the configured customer controls, their actual coverage, and evidence of operation still need assessment. A provider certificate can be evidence for inherited controls without certifying every customer decision. Use the cards to retrieve the different jobs of a finding, a filter, and compliance evidence. Next, use a similar control-and-evidence approach for spending.

Try it, then explain it.

Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.

Practice 4 questions

Sources & authorship

Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.