Banking PII must be access-controlled, encrypted, and standards-compliant. Using Cloud DLP and Google-recommended service-account practices, what should you do to control access to PII?

The correct answer ensures robust security and compliance for banking PII. Cloud Storage is a suitable, compliant solution for storing sensitive data, offering encryption at rest and in transit. Using multiple service accounts, each with specific, least-privilege permissions, prevents over-privileging and limits the blast radius in case of compromise. Attaching these service accounts to IAM groups simplifies management, allowing administrators to grant appropriate access to entire teams rather than individual users, which is scalable and reduces administrative overhead. Incorrect options: Assigning IAM roles to every employee and using a single service account for all project resources is insecure, violating the principle of least privilege and making auditing difficult. Using one service account for a Cloud SQL database and separate service accounts for each human user is better, but doesn't explicitly address the storage of PII or the use of IAM groups for scalable access management. Using Cloud Storage with one service account shared by all users is insecure, as it grants all users the same level of access, regardless of their actual need, and makes accountability challenging.