Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?

An organization’s security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google’s responsibility lies. They are mostly running workloads using Google Cloud’s Platform-as-a-Service (PaaS) offerings, including App Engine primarily.

Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?
A . Configuring and monitoring VPC Flow Logs
B . Defending against XSS and SQLi attacks
C . Manage the latest updates and security patches for the Guest OS
D . Encrypting all stored data

Answer: B

Explanation:

in PaaS the customer is responsible for web app security, deployment, usage, access policy, and content. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate