Examkin

Soru

Zorluk: OrtaRegulatory Compliance, Data Sovereignty, and Data Governance

An e-commerce platform headquartered in Japan is expanding operations into South Korea. To comply with local regulatory compliance and data sovereignty laws, all customer personally identifiable information (PII) must be stored and processed strictly within South Korean territory. Additionally, cloud service provider personnel must be prevented from accessing customer data without explicit, auditable authorization. As a Cloud Architect, which solution should you implement to satisfy these compliance and governance requirements?

  1. Enforce the gcp.resourceLocations Organization Policy constraint restricted to asia-northeast3 (Seoul), configure Customer-Managed Encryption Keys (CMEK) using key rings located in asia-northeast3, and enable Access Approval for the project.Cevap
  2. B
    Mandate Customer-Supplied Encryption Keys (CSEK) for all storage buckets, assign primitive Owner roles to service accounts managing data pipelines, and enable Access Transparency logging.
  3. C
    Grant Project Viewer roles to administrative service accounts, configure VPC Network Peering across global projects, and rely on IAM policies alone to prevent data exfiltration to external locations.
  4. D
    Enforce the gcp.resourceLocations Organization Policy set to asia-northeast3, grant primitive Editor roles to backend workloads, and rely on Google-managed encryption keys for default storage.

Cevap

Enforce the gcp.resourceLocations Organization Policy constraint set to asia-northeast3, configure Customer-Managed Encryption Keys (CMEK) hosted in asia-northeast3, and enable Access Approval.
Combining the gcp.resourceLocations Organization Policy constraint, regional CMEK key rings in asia-northeast3, and Access Approval provides a complete compliance architecture. It locks resource creation to South Korea, guarantees customer-managed encryption within the region, and requires manual consent before Google engineers can access system data.

Adım Adım Çözüm

1
Enforce deployment location boundaries
Prevents resources from being provisioned outside the target geographical jurisdiction.
Applying the gcp.resourceLocations Organization Policy constraint locked to asia-northeast3 guarantees that storage and compute assets remain strictly in South Korea.
2
Configure regional encryption key management
Maintains localized cryptographic control over data at rest.
Using Cloud KMS with CMEK stored in regional key rings in asia-northeast3 fulfills sovereignty needs without the burden of self-managing raw key infrastructure.
3
Implement administrative access controls for provider personnel
Requires prior permission before Google support engineers can access customer data.
Enabling Access Approval enforces an explicit approval workflow for any cloud provider support interventions, fulfilling strict administrative compliance requirements.

Anahtar Kavram

Regulatory Compliance, Data Sovereignty, and Data Governance
Bu soruyu puanla

Konular

Regulatory Compliance, Data Sovereignty, and Data Governance

Bu konudan daha fazla soru