Examkin

Soru

Zorluk: OrtaRegulatory Compliance, Data Sovereignty, and Data Governance

A financial brokerage firm based in Japan is migrating its customer portfolio database and analytics warehouse to Google Cloud. To satisfy national data sovereignty mandates and strict internal governance standards, the cloud architecture must enforce two key requirements:
1. All underlying storage resources containing customer records must be strictly restricted to Google Cloud regions within Japan.
2. Authorized internal data analysts querying datasets in BigQuery must be prevented from exfiltrating sensitive data to external, non-compliant Google Cloud storage resources or projects.

Which TWO architectural measures should you implement to satisfy these compliance and data governance requirements? (Select TWO.)

  1. Define an Organization Policy constraint using Resource Locations (`constraints/gcp.resourceLocations`) restricted to Japan location groups across the target resource hierarchy.Cevap
  2. B
    Grant primitive Owner roles to the security team on the BigQuery datasets to restrict data access and prevent unauthorized external export operations.
  3. Configure a VPC Service Controls security perimeter around the projects containing BigQuery and storage resources to prevent data movement outside approved perimeter boundaries.Cevap
  4. D
    Mandate Customer-Supplied Encryption Keys (CSEK) for all datasets, because Customer-Managed Encryption Keys (CMEK) cannot restrict key storage or data location to specific geographic regions.

Cevap

To meet the compliance requirements, you should configure an Organization Policy constraint for Resource Locations restricting provisioning to Japan regions, and establish a VPC Service Controls security perimeter around the analytical workloads to prevent data exfiltration.
Data residency is enforced using Resource Location organization policy constraints to guarantee resources are provisioned strictly within Japan regions. Data exfiltration controls require VPC Service Controls, which enforce perimeter boundaries around Google Cloud services (such as BigQuery) to prevent users from copying sensitive datasets to external projects.

Adım Adım Çözüm

1
Address data sovereignty and residency requirements
Enforce the `constraints/gcp.resourceLocations` Organization Policy constraint set to Japan locations across the resource hierarchy.
Organization policies centrally prevent users and deployment tools from creating storage or compute resources outside compliant geographic boundaries.
2
Address data exfiltration and governance controls
Construct a VPC Service Controls perimeter enclosing the project hosting BigQuery and Cloud Storage resources.
VPC Service Controls protect against data exfiltration by restricting network communication and data copying operations between protected services and unauthorized external GCP projects or locations.

Anahtar Kavram

Data sovereignty enforcement via Resource Locations organization policy paired with data exfiltration prevention using VPC Service Controls.
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru