Examkin

Question

Difficulty: MediumRegulatory Compliance, Data Sovereignty, and Data Governance

A public health agency in New Zealand is building a centralized patient registry on Google Cloud. To satisfy strict national health data sovereignty rules and data governance mandates, the organization has three mandatory security requirements:
1. All storage and compute resources holding patient records must be geographically restricted to the australia-southeast1 region.
2. Google Cloud support personnel must obtain explicit customer approval before accessing system logs or underlying infrastructure during troubleshooting.
3. The design must mitigate data exfiltration risks by preventing authorized internal users from transferring patient datasets to external, non-approved Cloud Storage buckets outside the environment boundary.

Which combination of Google Cloud architectural controls meets all three regulatory compliance requirements?

  1. Configure an Organization Policy enforcing the gcp.resourceLocations constraint restricted to australia-southeast1, enable Access Approval at the project hierarchy level, and establish a VPC Service Controls perimeter around the storage and analytical workloads.Answer
  2. B
    Assign primitive Owner IAM roles restricted exclusively to local system administrators, enable Access Approval for vendor support, and mandate Customer-Supplied Encryption Keys (CSEK) stored on-premises to enforce regional boundaries.
  3. C
    Enforce an Organization Policy for gcp.resourceLocations, mandate Customer-Supplied Encryption Keys (CSEK) managed in local hardware security modules to restrict data access, and implement standard IAM roles to prevent unauthorized bucket copies.
  4. D
    Enable Access Approval for support tickets, create custom IAM roles restricting user access, and rely on IAM storage permissions to block data transfers to external Google Cloud projects.

Answer

Configure an Organization Policy enforcing the gcp.resourceLocations constraint restricted to australia-southeast1, enable Access Approval at the project hierarchy level, and establish a VPC Service Controls perimeter around the storage and analytical workloads.
The correct answer combines the three essential Google Cloud controls required for compliance and governance: Organization Policy (`gcp.resourceLocations`) enforces physical data residency, Access Approval governs vendor support access, and VPC Service Controls creates a security perimeter that prevents data exfiltration even by authenticated users.

Step-by-Step Solution

1
Evaluate geographic data sovereignty enforcement
Applying the gcp.resourceLocations Organization Policy constraint strictly limits resource provisioning to australia-southeast1.
Organization policies provide centralized, declarative control over resource locations across the resource hierarchy.
2
Address vendor administrative access controls
Enabling Access Approval requires Google support engineers to seek explicit customer authorization prior to accessing data or logs.
Access Approval integrates with Access Transparency logs to give customers explicit approval workflows for cloud provider actions.
3
Address data exfiltration prevention controls
Defining a VPC Service Controls security perimeter isolates services such as Cloud Storage and BigQuery, preventing data egress to resources outside the perimeter.
IAM controls manage access identities, but VPC Service Controls defines security perimeters around GCP services to block authorized identity exfiltration.

Key Concept

Regulatory Compliance and Governance in Google Cloud
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic