GCP Professional Cloud Security Engineer Practice Question

Your organization is moving its collaboration platform to Google Workspace (SaaS). The security team is mapping controls to the shared responsibility model before the migration. Which statement accurately reflects how responsibilities are divided between Google and the customer in this SaaS scenario?

The customer is accountable for Gmail service availability, whereas Google defines and enforces data-loss-prevention policies for all mailboxes.
Google manages the customer's internal IAM groups, and the customer is responsible for firmware updates on Google's server hardware.
Google operates and patches the underlying infrastructure and Workspace applications, while the customer configures Drive sharing permissions and retention policies for its data.
Google supplies customer-managed encryption keys by default, and the customer must patch the operating systems that host Workspace services.

Report Issue

Answer Description

In a Software-as-a-Service offering such as Google Workspace, Google is responsible for operating, securing, and patching the service stack (data centers, network, and the Workspace application code). The customer, however, retains control over how the service is used - for example, setting sharing permissions, retention rules, and other policy configurations that govern its own data and users. The other options invert or misallocate duties: Google does not manage a customer's IAM groups, supply customer-managed keys by default, or define the customer's DLP rules, and customers do not patch Google servers or guarantee Workspace availability.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.