An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running inGoo...

An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running inGoogle Cloud and where Google's responsibility lies. They are mostly running workloads using Google Cloud's platform-as-a-Service (PaaS) offerings, includingApp Engine primarily.
Which area in the technology stack should they focus on as their primary responsibility when using App Engine?

A. Configuring and monitoring VPC Flow Logs B. Defending against XSS and SQLi attacks C. Managing the latest updates and security patches for the Guest OS D. Encrypting all stored data