Examkin

Question

Difficulty: MediumRegulatory Compliance, Data Sovereignty, and Data Governance

A Nordic shipping and maritime logistics company is migrating its container tracking system and customer data to Google Cloud. Regional regulations dictate that all stored data must physically reside within European Union boundaries, cloud service provider personnel access must require explicit administrative approval, and data exfiltration across network perimeters to external buckets must be blocked. Which TWO architectural actions should you implement to meet these governance and data sovereignty mandates? (Select TWO.)

  1. Set an Organization Policy using the resource locations constraint restricted to European Union regions, and enable Access Approval to require explicit administrator authorization before Google support can access data.Answer
  2. Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS key rings deployed in EU regions, and establish a VPC Service Controls perimeter around Cloud Storage and BigQuery resources.Answer
  3. C
    Implement Customer-Supplied Encryption Keys (CSEK) for all storage resources, requiring client applications to transmit raw AES-256 keys in every API call to satisfy access transparency rules without Cloud KMS.
  4. D
    Rely exclusively on Identity and Access Management (IAM) role bindings to restrict data access, assuming identity controls prevent authorized users from copying datasets to external Cloud Storage buckets.

Answer

The correct architectural steps are to enforce an Organization Policy for resource locations along with Access Approval, and to deploy Customer-Managed Encryption Keys (CMEK) in EU regions protected by a VPC Service Controls security perimeter.
Enforcing the `constraints/gcp.resourceLocations` Organization Policy restricted to EU locations guarantees data residency, while Access Approval prevents unauthorized Google operator access. Pairing CMEK stored in EU Cloud KMS key rings with VPC Service Controls ensures regional key control and prevents data exfiltration.

Step-by-Step Solution

1
Enforce strict data residency and access transparency controls.
Applying the `constraints/gcp.resourceLocations` Organization Policy restricts resource creation strictly to specified EU regions. Enabling Access Approval mandates explicit customer consent before Google personnel can access data.
Regulatory compliance mandates physical data localization within the EU and strict cloud provider access governance.
2
Configure CMEK and establish network perimeter boundaries.
Using Cloud KMS key rings located in EU regions for CMEK guarantees cryptographic data protection within the sovereignty boundary, while VPC Service Controls isolate services to prevent data exfiltration.
CMEK ensures regional key governance, and VPC Service Controls protect against data exfiltration across security perimeters.

Key Concept

Data Sovereignty, Access Approval, and Exfiltration Guardrails in GCP
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic