GCP Professional Cloud Security Engineer Practice Question

Your organization runs hundreds of Google Cloud projects for different product teams worldwide. A subset of these projects process U.S. patient records and must be included in an upcoming HIPAA audit. The compliance team needs an auditable way to define the exact Google Cloud resources that fall under the HIPAA scope, apply stronger encryption and network controls to them only, and prevent other unrelated projects from inheriting those constraints. Which design best meets these goals while minimizing operational overhead?

Enable Access Transparency organization-wide so auditors can filter provider access logs to identify the projects that handled HIPAA data.
Place all projects in a single Shared VPC and rely on subnet-level firewall rules to identify and secure HIPAA traffic when needed.
Create a dedicated "HIPAA" folder under the organization, move every project that stores ePHI into it, and attach HIPAA-specific Organization Policies and hierarchical firewall rules to that folder.
Apply a hipaa=true label to all resources that process protected health information and use Cloud Asset Inventory queries during the audit to demonstrate scope.

Report Issue

Answer Description

Creating a dedicated folder for HIPAA workloads establishes a clear, top-level node in the resource hierarchy that represents the compliance boundary. Moving all projects that handle ePHI into this folder lets you:

Attach Organization Policy constraints (for example, require CMEK, restrict resource locations) that automatically propagate to every current or future HIPAA project.
Apply Hierarchical Firewall policies and create isolated VPCs that are inherited only by projects in the folder.
Demonstrate to auditors that everything inside the folder is in scope and everything outside is not, without affecting unrelated teams.

Labels (even if consistently applied) do not enforce controls and are hard to prove as an authoritative boundary. Access Transparency only logs provider access and does not set scope. A single Shared VPC spanning all projects blurs the compliance boundary and makes it difficult to restrict policy inheritance to HIPAA workloads.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.