Examkin

Soru

Zorluk: OrtaRegulatory Compliance, Data Sovereignty, and Data Governance

A Canadian healthcare network is migrating its patient analytics platform to Google Cloud. National data sovereignty regulations mandate that all sensitive personal health information remains physically stored within Canada, data encryption keys are managed by the customer within the designated Canadian region, and any emergency administrative access by cloud service provider personnel requires explicit prior authorization and logging. Which architectural strategy fulfills all regulatory requirements while minimizing operational overhead?

  1. Configure an Organization Policy enforcing the Resource Locations constraint to northamerica-northeast1, manage encryption using Cloud KMS Customer-Managed Encryption Keys (CMEK) located in Montreal, and enable Access Approval with Access Transparency.Cevap
  2. B
    Implement Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets and BigQuery datasets, storing the key material exclusively on-premises and passing raw keys with every API request.
  3. C
    Assign primitive Owner roles to internal audit service accounts and configure IAM conditional bindings based on client IP addresses to enforce regional boundary controls.
  4. D
    Deploy IAM role bindings restricting resource access to Canadian service accounts, relying on standard identity permissions to prevent data exfiltration to external projects.

Cevap

Configure an Organization Policy enforcing the Resource Locations constraint to northamerica-northeast1, manage encryption using Cloud KMS Customer-Managed Encryption Keys (CMEK) located in Montreal, and enable Access Approval with Access Transparency.
The combination of Organization Policy resource location constraints, regional CMEK in Cloud KMS, Access Transparency, and Access Approval completely satisfies physical residency, key governance, and operator access controls required by regulatory frameworks while preserving native platform features.

Adım Adım Çözüm

1
Enforce physical data residency boundaries
Applying the `gcp.resourceLocations` Organization Policy constraint restricts resource creation strictly to the `northamerica-northeast1` (Montreal) region.
This guarantees that storage resources and compute instances cannot be provisioned outside designated Canadian geographic boundaries.
2
Establish key governance and encryption control
Utilizing Cloud KMS Customer-Managed Encryption Keys (CMEK) hosted in the Montreal region provides full key lifecycle control and rotation capabilities natively integrated with GCP services.
CMEK meets compliance requirements for customer key control without the operational overhead of managing raw AES keys with CSEK.
3
Implement cloud provider access governance
Enabling Access Transparency provides near real-time audit logs when Google personnel interact with customer data, while Access Approval requires explicit customer permission before Google personnel can access data for support or operational tasks.
This satisfies legal mandates requiring explicit prior consent and auditability for administrative access by third-party cloud provider staff.

Anahtar Kavram

Regulatory Compliance and Data Governance Controls
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru