Google Professional Cloud Security Engineer Question 487
Select 3Google Cloud PlatformYour organization processes sensitive financial data and must comply with regional data residency requirements for the European Union (EU). You are tasked with configuring Google Cloud to ensure compliance. Which of the following steps would you take to enforce compliance and maintain security controls for this requirement?
- A
Use Assured Workloads to restrict data processing and storage to EU regions.
- B
Enable Access Transparency to log access to sensitive data by Google administrators.
- C
Configure an organizational policy to restrict resource creation to specific EU regions.
- D
Enable Access Approval to require explicit permissions for Google support access.
- E
Set up a VPC Service Control perimeter to prevent data exfiltration outside the EU.
Show answer and explanation
Correct answers: A, C, E
Explanation
To comply with EU regional data residency requirements, you need to ensure that data is restricted to specific regions. Assured Workloads enforces regional restrictions, organizational policies prevent resource creation outside the EU, and VPC Service Controls prevent data exfiltration. While Access Transparency and Access Approval are important for auditing and controlling access, they do not directly address regionalization requirements in this scenario.
- A. Correct.
Assured Workloads is designed to enforce compliance requirements, such as regionalization of data, by restricting workloads to specific regions like the EU. This is a correct step for meeting regional compliance requirements.
- B. Incorrect.
Access Transparency logs provide visibility into administrative access by Google personnel but do not enforce regional data residency. While useful for auditing, it does not directly address the compliance requirement in this scenario.
- C. Correct.
Organizational policies can restrict resource creation to specific regions, helping enforce compliance with regional data residency requirements. This is a correct step for this scenario.
- D. Incorrect.
Access Approval adds a layer of control over Google support access but does not enforce regionalization of data or compliance with EU data residency requirements.
- E. Correct.
VPC Service Controls create a security perimeter to prevent data exfiltration outside a trusted network or region. This complements regionalization efforts and is a correct step for ensuring compliance.