Google Professional Data Engineer Question 14
Select 3Google Cloud PlatformYour organization collects sensitive customer data from users in the European Union (EU) and stores it in Google Cloud. Due to data sovereignty requirements, you must ensure that the data remains within the EU boundaries and complies with GDPR regulations. Which of the following steps should you take to meet these requirements?
- A
Use a Google Cloud region located in the EU, such as 'europe-west1', to store the data.
- B
Enable CMEK (Customer-Managed Encryption Keys) and host the encryption keys in an EU region.
- C
Use a multi-region bucket spanning both the EU and US regions for redundancy and compliance.
- D
Implement an organization policy to restrict resource creation to EU-based regions.
- E
Rely on Google's default encryption and do not configure any additional settings.
Show answer and explanation
Correct answers: A, B, D
Explanation
To comply with data sovereignty and GDPR requirements, sensitive EU customer data must remain within EU boundaries. Using EU-based Google Cloud regions, enabling CMEK with encryption keys stored in the EU, and applying organization policies to enforce regional restrictions ensure that the data is securely stored and processed in compliance with regulations. Multi-region buckets spanning non-EU regions and relying solely on default encryption do not meet these specific requirements.
- A. Correct.
Correct: Storing data in an EU region such as 'europe-west1' ensures compliance with data sovereignty requirements by keeping the data physically within the EU.
- B. Correct.
Correct: Enabling CMEK allows you to manage encryption keys and ensures they are stored in an EU region, giving you control over encryption and aligning with GDPR requirements.
- C. Incorrect.
Incorrect: A multi-region bucket spanning both the EU and US does not meet EU data sovereignty requirements because the data could be stored or processed outside the EU.
- D. Correct.
Correct: Implementing an organization policy to restrict resource creation to EU-based regions ensures that developers and teams cannot accidentally create resources outside the EU.
- E. Incorrect.
Incorrect: While Google's default encryption provides baseline security, it does not address specific data sovereignty or regional storage requirements.