An organization must enforce strict data sovereignty and data governance controls for sensitive data stored in Google Cloud. The compliance mandate requires restricting all data storage resources to a specific geographic region and managing encryption keys centrally using Google Cloud services. Which TWO architectural actions should the organization take to satisfy these requirements? (Select TWO)
- Enforce the Resource Locations organization policy constraint (constraints/gcp.resourceLocations) to restrict resource deployment exclusively to the designated region.Cevap
- Encrypt cloud storage and database resources using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS within the designated region.Cevap
- CRequire Customer-Supplied Encryption Keys (CSEK) by transmitting raw key material in headers with every storage API request to meet central key management standards.
- DGrant primitive Owner roles to security auditors across all projects to ensure full oversight and administrative access to compliance settings.
Cevap
Enforce the Resource Locations organization policy constraint to restrict resource deployment to the designated region, and encrypt storage resources using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS.
To comply with data sovereignty and governance mandates, organizations should enforce the Resource Locations organization policy constraint to restrict resource creation to specific geographical boundaries, and use Customer-Managed Encryption Keys (CMEK) stored in regional Cloud KMS to maintain centralized control and auditability over key lifecycles.
Adım Adım Çözüm
Anahtar Kavram
Data sovereignty controls using Organization Policies and centralized key governance with Customer-Managed Encryption Keys (CMEK).