Examkin

Soru

Zorluk: ZorRegulatory Compliance, Data Sovereignty, and Data Governance

A government-owned energy enterprise based in Denmark is migrating its critical smart-grid telemetry and customer billing datasets to Google Cloud. To comply with national data sovereignty regulations and European data protection mandates, the lead cloud architect must satisfy two primary compliance requirements: ensure that all newly provisioned data storage resources remain strictly within the Denmark/Nordic region, and prevent authorized project identity credentials from exfiltrating sensitive data to external Google Cloud resources outside the organization's control. Which TWO architectural controls should the architect implement to satisfy these requirements?

  1. Enforce an Organization Policy with the Resource Locations constraint (constraints/gcp.resourceLocations) restricted to the europe-north1 region across the resource hierarchy.Cevap
  2. Configure a VPC Service Controls perimeter around the project enclosing BigQuery and Cloud Storage to restrict data movement across the perimeter boundary.Cevap
  3. C
    Require Customer-Supplied Encryption Keys (CSEK) for all data at rest to ensure Google Cloud automatically enforces geographic key management boundaries.
  4. D
    Assign the primitive Owner IAM role to the compliance service account to grant full control over audit log retention policies and prevent access revocations.

Cevap

The architect must enforce an Organization Policy using the Resource Locations constraint restricted to europe-north1, and configure a VPC Service Controls perimeter around BigQuery and Cloud Storage.
Data sovereignty and data governance require complementary controls at both the resource provisioning layer and the network perimeter layer. Restricting deployment locations via the Resource Locations organization policy ensures that resources are created exclusively within the approved geographic zone (europe-north1). Simultaneously, wrapping sensitive services within a VPC Service Controls perimeter ensures that even fully authenticated IAM principals cannot extract data to external buckets or datasets outside the organization.

Adım Adım Çözüm

1
Address data residency constraints at the resource deployment boundary.
Applying the constraints/gcp.resourceLocations organization policy prevents project administrators from creating storage resources outside the allowed region (europe-north1).
Organization policies provide declarative governance controls that restrict physical deployment regions.
2
Mitigate data exfiltration risks from compromised or authorized identities.
Defining a VPC Service Controls security perimeter around Cloud Storage and BigQuery isolates the data services from unauthorized external projects and internet endpoints.
IAM permissions authorize WHO can access data, whereas VPC Service Controls restrict WHERE data can be moved, blocking exfiltration to external resources.

Anahtar Kavram

Data Sovereignty and Perimeter Security Controls
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru