Examkin

Question

Difficulty: HardRegulatory Compliance, Data Sovereignty, and Data Governance

An Australian telecommunications enterprise is migrating its customer analytics platform to Google Cloud. To comply with national data sovereignty regulations and strict audit requirements, the architecture must ensure that customer personally identifiable information (PII) is stored and processed exclusively within Australian geographic boundaries, Google support engineers cannot access customer data without explicit loggable authorization, and authorized internal users are prevented from exfiltrating data to external resources outside the organization. Which TWO architectural controls should the Cloud Architect implement to meet these requirements?

  1. Enforce an Organization Policy using the Resource Locations constraint (constraints/gcp.resourceLocations) restricted to Australian regions to block resource creation outside allowed geographic boundaries.Answer
  2. Configure a VPC Service Controls perimeter around projects containing PII to prevent data exfiltration, and enable Access Approval to mandate explicit customer authorization prior to Google support access.Answer
  3. C
    Mandate Customer-Supplied Encryption Keys (CSEK) across Cloud Storage buckets and BigQuery datasets to enforce physical data residency within local data centers.
  4. D
    Grant IAM Storage Object Viewer roles to local administrators and rely on IAM policies alone to prevent data exfiltration to external storage buckets.

Answer

The Cloud Architect must enforce an Organization Policy with the Resource Locations constraint restricted to Australian regions and deploy a VPC Service Controls security perimeter combined with Access Approval.
To fulfill strict data sovereignty mandates, enforcing an Organization Policy with `constraints/gcp.resourceLocations` prevents resources from being provisioned outside specified regions. Combining VPC Service Controls with Access Approval provides robust governance by blocking unauthorized data exfiltration across project boundaries and requiring explicit customer consent before Google support engineers can access underlying data.

Step-by-Step Solution

1
Address data sovereignty and geographic location restrictions.
Apply the Organization Policy constraint `constraints/gcp.resourceLocations` limited strictly to `in:australia-southeast1-locations` and `in:australia-southeast2-locations`.
This policy guarantees that compute, storage, and managed data services cannot be provisioned outside Australian borders.
2
Address data exfiltration protection and Google administrative access controls.
Define VPC Service Controls perimeters around PII storage and processing projects, and activate Access Approval across the resource hierarchy.
VPC Service Controls create a cryptographic and network boundary preventing network egress to unauthorized external GCP projects, while Access Approval requires customer confirmation before Google staff access data for support requests.

Key Concept

Enforcing data sovereignty and data governance using Resource Locations Organization Policies, VPC Service Controls, and Access Approval
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic