Examkin

Soru

Zorluk: Çok zorRegulatory Compliance, Data Sovereignty, and Data Governance

A global healthcare SaaS provider processing protected citizen health records for an Asia-Pacific government entity must comply with strict national data sovereignty regulations and audit requirements. The compliance mandate specifies three requirements:
1. All underlying storage data at rest and cryptographic key management boundaries must be restricted to a single specified GCP region.
2. Google support personnel must be explicitly authorized prior to viewing any customer data during administrative operations, with all access attempts fully audited.
3. Authorized service accounts and insider identities within the project must be programmatically blocked from exfiltrating sensitive datasets to unauthorized external Google Cloud Storage buckets.

Which THREE architectural controls must be implemented in Google Cloud to satisfy these compliance and data governance requirements?

  1. Enforce the Resource Locations organization policy (constraints/gcp.resourceLocations) at the folder level restricting resource creation to the target region, and use Customer-Managed Encryption Keys (CMEK) hosted on Cloud KMS key rings provisioned within that same region.Cevap
  2. Enable Access Approval and Access Transparency at the organization level to require explicit customer approval before Google engineers access data and to maintain immutable audit logs of support actions.Cevap
  3. Construct a VPC Service Controls perimeter around sensitive resources (such as Cloud Storage and BigQuery) to prevent data copying or exfiltration to projects outside the perimeter.Cevap
  4. D
    Deploy Customer-Supplied Encryption Keys (CSEK) for all storage buckets and manually manage raw cryptographic keys within application source code deployed on Compute Engine instances.
  5. E
    Assign primitive IAM Owner and Editor roles to the central compliance service account so that it can bypass regional resource policies during audit automated remediation.
  6. F
    Rely exclusively on standard IAM roles (such as roles/storage.objectViewer) without VPC network boundary controls to restrict service accounts from sending data to external endpoints.

Cevap

The three required controls are: (1) Enforcing the Resource Locations organization policy paired with regional Customer-Managed Encryption Keys (CMEK), (2) Enabling Access Approval and Access Transparency for Google staff operations, and (3) Constructing a VPC Service Controls perimeter to protect against data exfiltration.
To satisfy comprehensive data sovereignty, data governance, and compliance mandates, three distinct controls must be combined. First, enforcing the Resource Locations organization policy alongside regionally configured CMEK ensures data and keys never leave the designated sovereign region. Second, combining Access Approval with Access Transparency gives the enterprise explicit control over and audit visibility into Google support staff access. Third, establishing a VPC Service Controls perimeter isolates sensitive resources like Cloud Storage and BigQuery, preventing exfiltration even by compromised or malicious internal identities.

Adım Adım Çözüm

1
Address data residency and cryptographic key boundary requirements.
Applying the `constraints/gcp.resourceLocations` organization policy restricts data storage and compute resource creation to the target region. Using Cloud KMS CMEK with key rings created in that exact region ensures encryption keys remain within the sovereign boundary.
This directly guarantees both data at rest and cryptographic operations comply with national residency laws.
2
Address administrative access control and visibility over Google personnel.
Enabling Access Approval ensures that any administrative intervention requested by Google support requires customer consent. Access Transparency generates audit logs detailing Google personnel access.
This satisfies legal requirements regarding administrative vendor oversight and data access auditing.
3
Address insider threat and data exfiltration protection.
Configuring VPC Service Controls around storage and analytics services creates a perimeter boundary that blocks authorized identities from transferring data to GCP projects outside the perimeter.
IAM alone cannot prevent an authorized user or service account from copying data to an external bucket.

Anahtar Kavram

Multi-Layered Sovereign Compliance Architecture
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru