Examkin

Question

Difficulty: HardRegulatory Compliance, Data Sovereignty, and Data Governance

A retail banking institution based in Canada is migrating its core ledger and customer analytics platform to Google Cloud. To satisfy strict Canadian data sovereignty mandates and regulatory directives, the architecture must fulfill three core security requirements:
1. All persistent data at rest must be restricted exclusively to Google Cloud regions located within Canada.
2. Exfiltration of sensitive financial records to external Google Cloud resources by compromised credentials must be prevented.
3. Any access to customer data by Google support or engineering personnel must require explicit, just-in-time approval from the bank's security operations team with cryptographic verification.

Which combination of Google Cloud security controls should the Cloud Architect implement to satisfy these requirements?

  1. Enforce an Organization Policy with the `constraints/gcp.resourceLocations` constraint restricted to Canadian regions, establish a VPC Service Controls perimeter encompassing storage and database services, and enable Access Approval along with Access Transparency.Answer
  2. B
    Mandate Customer-Supplied Encryption Keys (CSEK) for all storage resources to maintain raw key material on-premises, and grant primitive Owner roles to the compliance auditing service accounts.
  3. C
    Configure restrictive Cloud IAM roles across all storage resources and remove public IP addresses from compute instances, relying strictly on IAM policy bindings to prevent authorized credentials from copying data to external Cloud Storage buckets.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to workload service accounts, and enforce Cloud KMS Customer-Managed Encryption Keys with automatic multi-region key replication across North America.

Answer

The correct architecture enforces an Organization Policy using `constraints/gcp.resourceLocations` set to Canadian regions, establishes a VPC Service Controls perimeter around sensitive storage and database services, and enables Access Approval combined with Access Transparency for Google support access.
Enforcing the `constraints/gcp.resourceLocations` Organization Policy guarantees that resources are provisioned strictly within Canadian regions. VPC Service Controls restrict communication between services, blocking exfiltration to unauthorized storage destinations. Access Approval and Access Transparency fulfill regulatory requirements by ensuring Google support cannot inspect customer data without explicit, logged permission.

Step-by-Step Solution

1
Evaluate data sovereignty requirements
Apply `constraints/gcp.resourceLocations` at the organization or folder level, restricting resource creation strictly to `in:canada-locations` (such as `northamerica-northeast1` and `northamerica-northeast2`).
Organization policies provide declarative enforcement preventing users from creating resources outside specified geographic regions.
2
Address data exfiltration risks
Define a VPC Service Controls perimeter around storage and database services (e.g., Cloud Storage, BigQuery, Cloud Spanner).
VPC Service Controls create an isolated security boundary that prevents authorized identities from copying data into GCP resources located outside the defined perimeter.
3
Enforce administrative access governance
Enable Access Approval and Access Transparency logging across the organization.
Access Transparency provides logs of Google administrator actions, while Access Approval requires explicit authorization from the customer before Google support personnel can view customer data.

Key Concept

Data Sovereignty and Perimeter Security Controls
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic