Examkin

Question

Difficulty: EasyRegulatory Compliance, Data Sovereignty, and Data Governance

An enterprise operating in the European Union must comply with data sovereignty regulations requiring all newly provisioned data storage resources, such as Cloud Storage buckets and BigQuery datasets, to reside strictly within EU regions. Which Google Cloud feature should the cloud architect configure to enforce this policy centrally across all projects in the organization?

  1. Define an Organization Policy with the Resource Locations constraint configured to allow only EU locations.Answer
  2. B
    Configure VPC Service Controls to prevent data exfiltration to unauthorized external network endpoints.
  3. C
    Require Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets to establish data residency boundaries.
  4. D
    Grant the Owner primitive IAM role at the organization level to compliance officers so they can audit and manage regional resources.

Answer

Define an Organization Policy using the Resource Locations constraint to limit resource creation strictly to specified EU regions.
Defining an Organization Policy with the Resource Locations constraint (`constraints/gcp.resourceLocations`) allows administrators to restrict the set of physical regions where location-based resources (such as Cloud Storage buckets and BigQuery datasets) can be created, ensuring strict compliance with data sovereignty regulations.

Step-by-Step Solution

1
Identify the primary compliance requirement.
The goal is to enforce data sovereignty by restricting resource creation locations across the Google Cloud organization hierarchy.
Data sovereignty mandates require strict geographic control over where data at rest resides.
2
Evaluate Google Cloud governance mechanisms for location enforcement.
The Resource Locations organization policy constraint (`constraints/gcp.resourceLocations`) defines the set of locations where location-based Google Cloud resources can be created.
Organization policies act as centralized guardrails that block unauthorized resource creation across projects.

Key Concept

Resource Location Restrictions via Organization Policies
Estimated Time:45s
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic