Examkin

Question

Difficulty: MediumRegulatory Compliance, Data Sovereignty, and Data Governance

An energy utility enterprise based in Australia is deploying its smart meter telemetry processing platform to Google Cloud. National regulatory mandates require that all customer consumption records remain strictly within Australia. Additionally, the security policy dictates that all data at rest must be encrypted using keys controlled by the enterprise within the designated Australian region, exfiltration to unauthorized external cloud environments must be prevented, and Google support personnel access to underlying infrastructure must require explicit customer authorization. Which architectural strategy meets all regulatory compliance, data sovereignty, and security requirements?

  1. Enforce an Organization Policy with the Resource Locations constraint set to australia-southeast1, encrypt Cloud Storage and BigQuery datasets with Customer-Managed Encryption Keys (CMEK) located in australia-southeast1, establish a VPC Service Controls perimeter around the project resources, and configure Access Approval.Answer
  2. B
    Mandate Customer-Supplied Encryption Keys (CSEK) for all storage buckets and BigQuery tables to avoid using Cloud KMS key rings, while granting primitive Owner roles to security administrators to oversee compliance.
  3. C
    Define fine-grained IAM roles with IAM Conditions to restrict user operations, and rely solely on Cloud Storage IAM permissions to prevent data exfiltration to external storage buckets.
  4. D
    Assign the Service Account Admin role to compute resources processing the telemetry, and enable Cloud Storage Bucket Lock to enforce data residency constraints across multi-region locations.

Answer

The optimal solution enforces an Organization Policy with the Resource Locations constraint set to australia-southeast1, encrypts data using regional Customer-Managed Encryption Keys (CMEK), isolates resources using VPC Service Controls, and enables Access Approval.
Combining an Organization Policy for resource location restriction (`australia-southeast1`), regional Customer-Managed Encryption Keys (CMEK), VPC Service Controls perimeters, and Access Approval provides a complete regulatory compliance framework. It enforces data sovereignty, key control, exfiltration prevention, and administrative access approval.

Step-by-Step Solution

1
Enforce strict geographical data residency boundaries.
Applying the `constraints/gcp.resourceLocations` Organization Policy restricted to `australia-southeast1` prevents resources from being created outside Australia.
Regulatory compliance mandates that data must physically reside in the specified jurisdiction.
2
Implement enterprise key management and access controls.
Using Cloud KMS CMEK in `australia-southeast1` satisfies key ownership demands, while VPC Service Controls creates a security perimeter preventing data egress.
CMEK ensures compliance with customer key control policies without taking on manual raw key management, and VPC Service Controls mitigates exfiltration risks.
3
Establish access transparency and administrative oversight.
Enabling Access Approval ensures any access request by Google cloud operations personnel requires explicit authorization.
Regulatory frameworks for sensitive data often require formal customer sign-off before cloud provider engineers can inspect underlying systems.

Key Concept

Data Sovereignty and Security Governance Frameworks in GCP
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic