Examkin

Soru

Zorluk: OrtaRegulatory Compliance, Data Sovereignty, and Data Governance

A multinational financial technology enterprise headquartered in Brazil is migrating its core payment processing platform to Google Cloud. To comply with local regulatory mandates and strict data sovereignty laws, the cloud solution architecture must satisfy three mandatory requirements:
1. All Cloud Storage buckets and BigQuery datasets storing sensitive customer data must strictly be restricted to provisioning in the `southamerica-east1` (São Paulo) region.
2. All stored data must be encrypted at rest using keys where the organization maintains administrative control over key management, access policies, and rotation schedules in Cloud KMS.
3. Authorized IAM users and service accounts inside the environment must be prevented from exfiltrating data to external Google Cloud projects or non-approved resources.

Which combination of Google Cloud architectural controls satisfies all of these compliance and data sovereignty requirements?

  1. Enforce the gcp.resourceLocations organization policy constraint restricted to southamerica-east1, configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS in southamerica-east1 for Cloud Storage and BigQuery, and define a VPC Service Controls security perimeter around the resources.Cevap
  2. B
    Enforce the gcp.resourceLocations organization policy constraint restricted to southamerica-east1, mandate Customer-Supplied Encryption Keys (CSEK) for all storage resources to maintain raw key material on-premises, and rely on IAM fine-grained permissions to block external data copying.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS in southamerica-east1 and enforce granular IAM custom roles across all projects, relying on IAM privilege boundary enforcement to prevent data exfiltration to external Google Cloud resources.
  4. D
    Assign the primitive Editor IAM role to administrative service accounts, use Google-managed encryption keys for Cloud Storage and BigQuery, and deploy Cloud Armor network security policies to restrict data movements to southamerica-east1.

Cevap

Enforce the gcp.resourceLocations organization policy constraint restricted to southamerica-east1, configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS in southamerica-east1 for Cloud Storage and BigQuery, and define a VPC Service Controls security perimeter around the resources.
The correct solution combines the `gcp.resourceLocations` organization policy constraint to enforce geographic location boundaries, Customer-Managed Encryption Keys (CMEK) in Cloud KMS to maintain key management governance over at-rest encryption, and VPC Service Controls to form a perimeter preventing data exfiltration outside the defined environment.

Adım Adım Çözüm

1
Enforce Geographic Data Residency
Applying the `gcp.resourceLocations` organization policy constraint at the project or folder level strictly restricts resource creation to the specified region (`southamerica-east1`).
Regulatory compliance requires guaranteed physical placement of data storage and compute resources within specific national boundaries.
2
Implement Key Governance via CMEK
Configuring Customer-Managed Encryption Keys (CMEK) allows the enterprise to retain key lifecycle management, rotation, and revocation control within Cloud KMS without managing raw encryption keys on-premises.
CMEK integrates natively with Cloud Storage and BigQuery to fulfill regulatory cryptographic control requirements.
3
Prevent Data Exfiltration with VPC Service Controls
Constructing a VPC Service Controls security perimeter isolates Google Cloud services and prevents authorized IAM identities from copying data to resources outside the designated perimeter.
IAM controls authorization for identities, but VPC Service Controls restricts service-level data movement and exfiltration channels.

Anahtar Kavram

Data Sovereignty and Exfiltration Prevention in GCP
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru