CLOUD-SECURITY-ENGINEER practice question 33 of 35

An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place…

An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization’s risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud. What solution would help meet the requirements?

Answer options

A: Ensure that firewall rules are in place to meet the required controls.

B: Set up Cloud Armor to ensure that network security controls can be managed for G Suite.

C: Network security is a built-in solution and Google’s Cloud responsibility for SaaS products like G Suite. Correct answer

D: Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.

Correct Answer:

C. Network security is a built-in solution and Google’s Cloud responsibility for SaaS products like G Suite.

Explanation

G Suite (now Google Workspace) is a Software-as-a-Service (SaaS) offering. In the SaaS shared responsibility model, the cloud provider (Google) is responsible for securing the underlying infrastructure, including the network, servers, and operating systems. The customer is responsible for managing their data, users, and access policies within the application. Therefore, the organization cannot and does not need to configure network-level controls like firewalls or VPCs for G Suite itself. The network security is a built-in part of the service managed by Google, and the organization's risk team should focus on the controls available within the G Suite Admin console.

Why Incorrect

A. Firewall rules are a feature of Google Cloud VPCs (IaaS/PaaS) and cannot be applied to the underlying network of a SaaS product like G Suite.
B. Cloud Armor is a WAF service that protects applications behind a Google Cloud Load Balancer; it is not used to manage security for G Suite.
D. VPC networks are used for IaaS and PaaS resources that a customer deploys, not for managing access to Google's SaaS applications.

References

1. Google Cloud Blog, "Shared responsibility model in GCP". This article outlines the division of responsibility. For SaaS, it states, "Google provides the entire stack... you are only responsible for your data and how you decide to use the service."

2. Google Cloud, "Shared responsibility and fate-sharing on GKE". While GKE-specific, it illustrates the general principle: "In a SaaS model, the cloud provider is responsible for securing the entire technology stack." This principle applies directly to G Suite.

3. Google Workspace Security Whitepaper, "Security and Compliance". This document details the security measures Google implements at the infrastructure and network level for Google Workspace, confirming it is Google's responsibility. Section: "Infrastructure Security".

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test