A South African telecommunications provider is building a data analytics platform on Google Cloud to process customer billing records and location telemetry. National regulations require that data must remain strictly within specified geographic boundaries and be protected against exfiltration, even by authenticated users with broad identity permissions. Additionally, encryption keys must be managed through Google Cloud services while respecting regional placement boundaries. Which two architectural controls should you implement to satisfy these compliance and data governance requirements? (Select TWO.)
- Establish a VPC Service Controls perimeter around the projects hosting BigQuery and Cloud Storage to prevent data exfiltration to unauthorized Google Cloud resources outside the perimeter.Answer
- Enforce the Resource Locations Organization Policy constraint (constraints/gcp.resourceLocations) and utilize Customer-Managed Encryption Keys (CMEK) housed in regional Cloud KMS key rings.Answer
- CMandate Customer-Supplied Encryption Keys (CSEK) for all data assets to avoid using Cloud KMS and satisfy key residency requirements.
- DGrant primitive IAM Owner roles to the central compliance administration service accounts so they can override exfiltration attempts directly.
Answer
Implement VPC Service Controls around the analytical storage resources to prevent data exfiltration, and enforce the Resource Locations organization policy constraint combined with localized Customer-Managed Encryption Keys (CMEK).
Combining VPC Service Controls with Resource Location organization policies and CMEK addresses both data exfiltration risks and geographic sovereignty mandates. VPC Service Controls constrain data movement at the network perimeter, while CMEK with location constraints ensures keys and encrypted data reside exclusively within approved geographic regions.
Step-by-Step Solution
Key Concept
Data Sovereignty and Perimeter Security
Estimated Time:2m 0s