Examkin

Question

Difficulty: HardRegulatory Compliance, Data Sovereignty, and Data Governance

A multinational financial services enterprise operating in South America must host its payment processing workloads and financial transaction archives on Google Cloud while complying with strict central bank data sovereignty mandates and regulatory audit requirements. The compliance framework dictates that all data and primary infrastructure must remain geographically restricted to the São Paulo region, and any emergency administrative access by cloud provider support personnel must require explicit, real-time approval and auditing from the enterprise security team. Which TWO architectural controls should the lead cloud architect implement to meet these requirements?

  1. Enforce the `constraints/gcp.resourceLocations` Organization Policy at the top-level organization folder to restrict resource creation strictly to `southamerica-east1`.Answer
  2. Enable Access Approval alongside Access Transparency to require explicit permission before Google personnel can access data and to maintain an immutable log of access reasons.Answer
  3. C
    Grant IAM Viewer and Storage Object Viewer roles to enterprise audit teams while relying on IAM policies alone to prevent data exfiltration to external Cloud Storage buckets.
  4. D
    Require Customer-Supplied Encryption Keys (CSEK) managed on-premises for all analytical BigQuery datasets to satisfy cloud provider key governance mandates.

Answer

The enterprise must enforce the `constraints/gcp.resourceLocations` Organization Policy to restrict resource creation strictly to the `southamerica-east1` region, and enable Access Approval along with Access Transparency to ensure explicit security team approval and immutable logging for any Google support access.
To satisfy strict regional data sovereignty mandates, enforcing the `constraints/gcp.resourceLocations` Organization Policy ensures all resources remain within `southamerica-east1`. To satisfy administrative auditing and cloud provider access oversight requirements, enabling Access Approval gates support access behind explicit customer permissions while Access Transparency provides audit logs of vendor access.

Step-by-Step Solution

1
Address data sovereignty and regional confinement mandates.
Apply the `constraints/gcp.resourceLocations` organization policy constraint specifying `in:southamerica-east1-locations` to prevent resource deployment outside the approved geographical jurisdiction.
Organization policies provide programmatic guardrails that block infrastructure provisioning in unapproved geographic locations regardless of IAM permissions.
2
Address cloud provider access governance and auditing mandates.
Enable Access Approval to establish an explicit sign-off workflow when Google engineers require system access, and enable Access Transparency to generate audit logs of provider personnel activities.
Regulatory compliance frameworks often demand that third-party access (including cloud vendor administrators) is gated by explicit authorization and recorded in audit trails.

Key Concept

Data Sovereignty Guardrails and Cloud Provider Access Controls
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic