Examkin

Soru

Zorluk: ZorRegulatory Compliance, Data Sovereignty, and Data Governance

A multinational financial institution operating in the European Union is migrating a mission-critical workload to Google Cloud. To satisfy strict regulatory compliance mandates regarding EU data sovereignty and data governance, the lead architect must design a solution that satisfies the following four requirements:
1. All data stored in Cloud Storage and BigQuery must be restricted exclusively to EU multi-regions or EU sub-regions.
2. Cryptographic keys used for encryption at rest must be managed by the customer within an EU location, and Google personnel access to customer data or key material must require explicit prior customer approval and full auditability.
3. Authorized internal service accounts and users must be prevented from exfiltrating data to external Cloud Storage buckets outside the organization's boundary.

Which architectural combination of Google Cloud security and governance controls fulfills all specified regulatory requirements?

  1. Configure an Organization Policy with the Resource Locations constraint restricting deployments to EU locations, encrypt storage resources using Customer-Managed Encryption Keys (CMEK) located in EU key rings, enable Access Approval and Access Transparency, and enforce a VPC Service Controls perimeter around the workload projects.Cevap
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) managed on-premises for all storage services, grant Project Owner and Editor primitive roles to the compliance team to override location constraints, and rely on Cloud Audit Logs to track exfiltration attempts.
  3. C
    Configure Customer-Managed Encryption Keys (CMEK) in EU locations, configure Access Approval and Access Transparency, enforce Resource Locations org policies, and rely exclusively on restrictive IAM permissions to prevent authorized service accounts from writing data to external Cloud Storage buckets.
  4. D
    Mandate Customer-Supplied Encryption Keys (CSEK) for all data workloads to avoid relying on Cloud KMS, configure Organization Policy constraints for resource locations, and deploy VPC Service Controls perimeters.

Cevap

The correct architecture uses an Organization Policy with the Resource Locations constraint restricted to EU regions, Cloud KMS Customer-Managed Encryption Keys (CMEK) hosted in EU key rings, Access Approval paired with Access Transparency for Google administrator access governance, and VPC Service Controls perimeters to prevent data exfiltration.
The correct solution integrates four vital GCP security primitives to meet comprehensive sovereignty and compliance rules: (1) Organization Policy resource location constraints (`constraints/gcp.resourceLocations`) block resource provisioning outside designated EU locations; (2) CMEK hosted in EU Cloud KMS key rings ensures customer-managed key lifecycle governance; (3) Access Approval and Access Transparency ensure Google support personnel cannot access underlying data without explicit approval and audited records; and (4) VPC Service Controls perimeters isolate Google Cloud API traffic, blocking data exfiltration even if an identity possesses valid IAM permissions.

Adım Adım Çözüm

1
Enforce strict physical data residency boundaries
Apply the Organization Policy constraint `constraints/gcp.resourceLocations` set to `in:eu-locations` across the resource hierarchy.
This guarantees that no user or automated process can instantiate compute or storage resources outside of European Union regions.
2
Establish key governance and administrative access controls
Deploy Customer-Managed Encryption Keys (CMEK) within EU Cloud KMS key rings, and enable Access Approval alongside Access Transparency.
CMEK ensures customer control over key rotation and location, while Access Approval requires explicit authorization before Google personnel can access data for support tickets, creating cryptographic and operational sovereignty.
3
Prevent data exfiltration vectors
Construct a VPC Service Controls security perimeter around the projects containing Cloud Storage and BigQuery.
IAM alone cannot prevent an authorized identity from reading sensitive data and writing it to an unmanaged bucket outside the organization. VPC Service Controls restrict service API communication based on network boundaries.

Anahtar Kavram

Regulatory Compliance, Data Sovereignty, and Data Governance in Google Cloud
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru