Examkin

Question

Difficulty: HardRegulatory Compliance, Data Sovereignty, and Data Governance

A fintech enterprise based in the United Kingdom is migrating its payment settlement and audit engine to Google Cloud to meet stringent UK Financial Conduct Authority (FCA) regulations and national data sovereignty requirements. The solution architecture must enforce four strict compliance mandates:
1. All storage and compute infrastructure must be physically restricted to the europe-west2 (London) region.
2. Exfiltration of sensitive customer transaction data to external, uncontrolled cloud environments by compromised authenticated identities must be prevented.
3. Google support personnel and system administrators must be explicitly prevented from accessing underlying customer data without real-time, explicit customer authorization.
4. All customer data at rest must be encrypted using keys managed within the customer's controlled key ring located in europe-west2.

Which architectural design fully satisfies all four compliance and sovereignty requirements?

  1. Enforce the Resource Locations organization policy constraint (constraints/gcp.resourceLocations) limited to europe-west2, establish a VPC Service Controls security perimeter around the project resources, enable Access Approval with Access Transparency, and configure Customer-Managed Encryption Keys (CMEK) residing in europe-west2.Answer
  2. B
    Grant granular IAM roles to security administrators, restrict Cloud KMS key rings to europe-west2, enable Access Approval, and rely exclusively on Cloud IAM deny policies without VPC Service Controls to block unauthorized external resource access.
  3. C
    Mandate Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage and BigQuery datasets, enforce the Resource Locations organization policy constraint restricted to europe-west2, and configure Access Transparency without enabling Access Approval.
  4. D
    Assign the Owner primitive IAM role to the dedicated compliance service account, enforce VPC Service Controls perimeters, enable Access Approval, and configure Customer-Managed Encryption Keys (CMEK) hosted in a multi-region location for high availability.

Answer

Enforce the Resource Locations organization policy constraint (constraints/gcp.resourceLocations) limited to europe-west2, establish a VPC Service Controls security perimeter around the project resources, enable Access Approval with Access Transparency, and configure Customer-Managed Encryption Keys (CMEK) residing in europe-west2.
The correct answer combines all four essential security and compliance primitives required by strict data sovereignty standards: Resource Locations Organization Policy for spatial residency, VPC Service Controls to prevent exfiltration, Access Approval to control Google personnel access, and regional CMEK for cryptographic governance.

Step-by-Step Solution

1
Address regional data residency mandates
Enforce `constraints/gcp.resourceLocations` set strictly to `europe-west2` across the resource hierarchy to prevent resource creation in unauthorized locations.
Organization policies provide declarative guardrails to guarantee compliance with national data sovereignty laws.
2
Mitigate data exfiltration risks
Configure a VPC Service Controls perimeter encompassing storage, database, and compute resources.
VPC Service Controls restrict communication between Google Cloud services and prevent authorized identities from copying data outside the defined perimeter.
3
Restrict cloud service provider administrator access
Enable Access Approval alongside Access Transparency.
Access Transparency provides logs of Google administrator actions, while Access Approval requires administrative access requests to be explicitly approved by customer security teams prior to data access.
4
Implement key management for cryptographic governance
Use Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS located in `europe-west2`.
CMEK allows the customer to control key lifecycle and location while leveraging native Google Cloud integration without the burden of storing raw key material on-premises (CSEK).

Key Concept

Data Sovereignty and Regulatory Governance Controls
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic