Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC)…

The Security Command Center (SCC) finding indicates a specific compliance drift: a Compute Engine VM within the Cardholder Data Environment (CDE) has an external IP address. The most direct and immediate remediation is to correct this specific misconfiguration. Reconfiguring the VM's network interface to remove the external IP address directly resolves the issue that triggered the finding. This action aligns with PCI DSS Requirement 1.3, which mandates prohibiting direct public access between the internet and any system component in the CDE. By removing the external IP, you eliminate the direct public access path, thus remediating the compliance drift at its source.

A. This is a preventative measure. While enforcing this organization policy is a best practice to prevent future occurrences, it does not remediate the existing VM that already has an external IP address.

B. Removing the tag only excludes the resource from the posture scan's scope. This action hides the compliance violation from the report but does not fix the underlying security risk, leaving the CDE exposed.

D. Marking a finding as fixed in the Security Command Center UI does not change the resource's actual configuration. The finding will reappear after the next scan because the root cause has not been addressed.

1. Google Cloud Documentation

Compute Engine

"Delete an external IP address": This document outlines the procedure for removing an external IP address from a VM's network interface. It states

"To deassign a static external IP address from a resource

you can either delete the network interface or change the network interface's configuration to not have an external IP address." This directly supports the action in option C.

Source: Google Cloud

Compute Engine Documentation

"Configure IP addresses for VM instances"

Section: "Delete an external IP address".

2. Google Cloud Documentation

Security Command Center

"PCI DSS v4.0 security posture": The PCI DSS v4.0 posture in SCC is designed to detect configurations that violate the standard's requirements. Requirement 1.3.1 states

"Implement a firewall at the perimeter of the CDE

which is configured to deny all traffic

and only allow traffic that is specifically authorized." A VM with a public IP in the CDE bypasses this intended perimeter

making its removal a necessary remediation step.

Source: Google Cloud

Security Command Center Documentation

"Supported security standards and benchmarks"

Section: "PCI DSS v4.0".

3. Google Cloud Documentation

Organization Policy Service

"Organization policy constraints": The documentation for the constraints/compute.vmExternalIpAccess constraint explains that it is used to "define the VM instances that are allowed to use external IP addresses." This confirms its role as a preventative control

not a tool for remediating an already-existing configuration.

Source: Google Cloud

Resource Manager Documentation

"Organization policy constraints"

Section: "Compute Engine constraints".