Examkin

Question

Difficulty: MediumRegulatory Compliance, Data Sovereignty, and Data Governance

An automotive manufacturer headquartered in Germany is deploying its autonomous vehicle telemetry and clinical research dataset on Google Cloud. To satisfy European Union data sovereignty regulations and internal governance policies, the cloud architecture must strictly ensure two outcomes: first, that storage and compute infrastructure cannot be provisioned outside designated European Union geographic locations; second, that Google support personnel cannot access customer data without explicit, loggable customer approval. Which TWO architectural mechanisms should the Lead Cloud Architect implement to satisfy these compliance requirements? (Select TWO.)

  1. Configure an Organization Policy with the Resource Locations constraint (constraints/gcp.resourceLocations) restricted to the EU location group across the resource hierarchy.Answer
  2. Enable Access Approval at the Organization level to require administrative review and approval before Google personnel can access data during support operations.Answer
  3. C
    Apply restrictive IAM Custom Roles with view-only privileges across all storage buckets to guarantee that authorized internal users cannot copy data to external Cloud Storage buckets in other regions.
  4. D
    Mandate Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets and BigQuery datasets to enforce region-restricted key ring locations managed in Cloud KMS.

Answer

The architect should enforce an Organization Policy with the Resource Locations constraint restricted to EU regions, and enable Access Approval at the Organization level to require customer consent before Google personnel can access data.
Enforcing the Resource Locations organization policy ensures that all newly provisioned resources (such as Compute Engine, GKE, BigQuery, and Cloud Storage) are constrained to European Union regions. Enabling Access Approval complements this by ensuring Google support and operations engineers cannot access customer datasets without explicit, audited authorization from the customer.

Step-by-Step Solution

1
Address data sovereignty and location restriction requirements.
Apply an Organization Policy using the `constraints/gcp.resourceLocations` constraint set to `in:eu-locations` to prevent resource creation in non-EU regions.
Organization policies provide programmatic guardrails ensuring resources are provisioned strictly within compliant geographic boundaries.
2
Address provider administrative access and data governance controls.
Enable Access Approval across the GCP organization hierarchy.
Access Approval ensures Google personnel must submit an explicit approval request before accessing customer data for support or operational tasks.

Key Concept

Data Sovereignty and Administrative Access Controls in GCP
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic