A. Correct.
Cloud Armor applies edge security policies, including IP deny lists and WAF rules, in front of external HTTP(S) load-balanced backends.

B. Incorrect.
Firewall rules do not provide the same global edge WAF behavior for HTTP requests.

C. Incorrect.
Cloud NAT is for outbound connectivity from private resources, not protecting public web backends.

D. Incorrect.
Packet Mirroring observes traffic but does not enforce blocking by itself.

A. Incorrect.
Web Security Scanner tests web applications, not VM runtime threats.

B. Incorrect.
Container Threat Detection focuses on containerized workloads.

C. Incorrect.
Rapid Vulnerability Detection finds exposed services and vulnerabilities, not runtime crypto-mining behavior.

D. Correct.
Virtual Machine Threat Detection detects suspicious VM runtime activity such as cryptocurrency mining.

A. Correct.
Organization Policy location constraints can restrict where supported resources are created.

B. Incorrect.
IAM roles grant permissions but do not constrain resource location.

C. Incorrect.
Firewall rules control network traffic, not where resources are provisioned.

D. Incorrect.
Labels are descriptive and do not enforce placement.

A. Incorrect.
Security Health Analytics reports misconfigurations, not detailed historical user activity.

B. Correct.
Cloud Audit Logs record administrative and data access activity and can be filtered by service account identity.

C. Incorrect.
DLP inspects sensitive data and does not determine service account usage history.

D. Incorrect.
Billing data can show cost impact but not precise access actions.

A. Incorrect.
Policy alone does not technically prevent misuse of an active session.

B. Correct.
Context-aware/session and reauthentication controls reduce risk from unattended authenticated sessions before sensitive actions.

C. Incorrect.
Disabling unused APIs is good hygiene but does not address active authenticated sessions.

D. Incorrect.
IAM exports support audit, not real-time prevention.

A. Incorrect.
CMEK protects data at rest, not data while it is being processed in memory.

B. Incorrect.
CSEK for disks also addresses data at rest, not in-use memory protection.

C. Correct.
Confidential Computing helps protect data in use by encrypting memory during processing.

D. Incorrect.
Lifecycle rules manage object retention and deletion, not encryption in use.

A. Incorrect.
Generalization reduces precision but is not ideal when authorized reversal is required.

B. Incorrect.
Redaction removes values and generally prevents re-identification.

C. Incorrect.
Inspection identifies sensitive data but does not transform it.

D. Correct.
Tokenization/pseudonymization replaces sensitive values with tokens while allowing authorized reversal or joins when designed properly.

A. Incorrect.
Standard CMEK does not keep key material fully outside Google Cloud.

B. Incorrect.
Cloud HSM is Google Cloud-hosted and does not satisfy full external key-material control.

C. Correct.
External Key Manager keeps key material outside Google Cloud and Key Access Justifications provides rationale for access decisions.

D. Incorrect.
Uploading the key to Cloud KMS means key material is no longer fully under external control.

A. Incorrect.
Monitoring workspaces do not centralize logs for Logs Explorer.

B. Incorrect.
Filters alone do not route logs into a central searchable bucket.

C. Incorrect.
Cloud Storage is useful for export and archival, but Logs Explorer searches Cloud Logging buckets.

D. Correct.
Aggregated sinks can route folder or organization logs into a centralized Logging bucket searchable with Logs Explorer.

A. Incorrect.
A SIEM can analyze logs, but the option does not provide Google Cloud-native immutable seven-year retention.

B. Correct.
Organization-level sinks centralize audit logs, and Cloud Storage retention lock provides tamper-resistant long-term retention.

C. Incorrect.
Security Command Center helps posture and threat visibility but is not immutable audit log retention.

D. Incorrect.
Fragmented 30-day retention fails the seven-year centralized audit requirement.