Examkin

Soru

Zorluk: OrtaRegulatory Compliance, Data Sovereignty, and Data Governance

A Switzerland-based aerospace defense contractor is migrating its telemetry and aircraft design repository to Google Cloud. Compliance mandates dictate that all data at rest must remain strictly confined to the europe-west6 (Zurich) region and protected against unauthorized cloud provider personnel access during administrative support. Furthermore, you must prevent authorized internal users from exfiltrating sensitive datasets to external Google Cloud storage locations outside the enterprise network boundary. Which TWO architectural controls should you implement to satisfy these regulatory compliance and data sovereignty requirements?

  1. Configure an Organization Policy using the constraints/gcp.resourceLocations constraint enforcing resource creation strictly in europe-west6, and enable Access Approval at the organization level.Cevap
  2. B
    Configure Customer-Supplied Encryption Keys (CSEK) stored in an external third-party key manager for all Cloud Storage buckets to satisfy encryption sovereignty.
  3. Establish a VPC Service Controls security perimeter around the Cloud Storage buckets and telemetry processing services containing sensitive data.Cevap
  4. D
    Grant the primitive IAM Owner role to the compliance security service account to automatically audit and enforce storage resource configurations across all projects.

Cevap

Enforcing regional resource creation via Organization Policies alongside Access Approval for cloud provider access governance, combined with VPC Service Controls security perimeters to prevent data exfiltration.
To satisfy regional data sovereignty and prevent unauthorized cloud provider access, applying an Organization Policy with constraints/gcp.resourceLocations restricts data and resource deployment to europe-west6, and Access Approval ensures Google engineers cannot access data without customer permission. To prevent data exfiltration, VPC Service Controls creates a cryptographic and network security boundary around GCP services, preventing data transfers to external GCP projects.

Adım Adım Çözüm

1
Enforce strict data residency and access transparency controls
Configuring constraints/gcp.resourceLocations restricts resource creation strictly to europe-west6, while Access Approval ensures explicit authorization is required for any Google support personnel access.
Meets regulatory data sovereignty and administrative access requirements.
2
Implement data exfiltration controls
Defining a VPC Service Controls security perimeter around Cloud Storage and data processing services prevents authorized entities from copying sensitive datasets outside the designated enterprise boundary.
IAM alone controls who has access, but VPC Service Controls restricts where data can be moved.

Anahtar Kavram

Regulatory Compliance, Data Sovereignty, and Data Governance
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru