Examkin

Question

Difficulty: HardRegulatory Compliance, Data Sovereignty, and Data Governance

A global pharmaceutical enterprise headquartered in Switzerland collects sensitive clinical trial data across multiple research facilities. The compliance department mandates two strict architectural requirements: first, all newly created data resources (such as Cloud Storage buckets and BigQuery datasets) must be physically restricted to the europe-west6 (Zurich) region to satisfy national data sovereignty laws; second, any administrative access by Google support personnel to underlying customer data must require explicit, real-time cryptographic approval from the enterprise compliance team. Which solution meets these compliance and data governance requirements?

  1. Enforce an Organization Policy using the Resource Locations constraint (constraints/gcp.resourceLocations) set to europe-west6, and enable Access Approval across the resource hierarchy to require explicit authorization before Google support can access data.Answer
  2. B
    Grant the primitive Owner role to compliance administrators and rely on IAM permission boundaries to prevent Google support engineers from accessing project resources stored in unauthorized regions.
  3. C
    Mandate Customer-Supplied Encryption Keys (CSEK) for all storage buckets, and rely on client-side key storage to automatically restrict resource creation locations to europe-west6.
  4. D
    Configure VPC Service Controls security perimeters around the projects to prevent authorized users from exfiltrating data, relying on perimeter restrictions rather than location constraints.

Answer

Enforce an Organization Policy using the Resource Locations constraint (constraints/gcp.resourceLocations) set to europe-west6, and enable Access Approval across the resource hierarchy to require explicit authorization before Google support can access data.
The correct answer combines the Resource Locations organization policy constraint (constraints/gcp.resourceLocations) to declaratively restrict storage and compute resource creation to europe-west6 with Google Cloud Access Approval to ensure Google support staff cannot access data without explicit, real-time approval from customer administrators.

Step-by-Step Solution

1
Evaluate data sovereignty location enforcement requirements.
The Resource Locations organization policy constraint (constraints/gcp.resourceLocations) prevents users from creating resources in any region other than the specified allowed locations (europe-west6).
Organization policies enforce centralized guardrails on resource provisioning location across projects or folders.
2
Evaluate provider access governance requirements.
Access Approval allows customers to explicitly approve or deny requests by Google personnel to access customer data during support operations.
This guarantees that no cloud operator access occurs without just-in-time approval from compliance officers.

Key Concept

Data Sovereignty and Provider Access Control using Resource Locations Organization Policies and Access Approval
Rate this question

Topics

Regulatory Compliance, Data Sovereignty, and Data Governance

More questions from this topic