Google Professional Data Engineer Question 18
Select 3Google Cloud PlatformYour company operates in a region with strict data privacy regulations, requiring all personally identifiable information (PII) to remain within the country’s borders. You are designing a data pipeline on Google Cloud that processes user data, some of which contains PII. Which of the following approaches ensures compliance with these regulations while maintaining operational efficiency?
- A
Use Cloud Storage in a regional bucket located in the required country to store PII data.
- B
Enable CMEK (Customer-Managed Encryption Keys) and store the encryption keys in a different country.
- C
Use BigQuery with a dataset set to the required region for processing PII data.
- D
Transfer all PII data to a Cloud Storage multi-region bucket for better availability.
- E
Use VPC Service Controls to create a service perimeter around the resources handling PII data.
Show answer and explanation
Correct answers: A, C, E
Explanation
To comply with strict data privacy regulations requiring PII to remain within the country, you must ensure that all data storage and processing operations are confined to the required region. Regional resources such as a Cloud Storage regional bucket and a BigQuery dataset set to the required region fulfill this requirement. Additionally, VPC Service Controls help enforce security policies and restrict unauthorized access, strengthening compliance efforts. However, using multi-region resources or storing encryption keys in another country violates these regulations.
- A. Correct.
Storing PII data in a regional bucket located in the required country ensures the data complies with the regulation to remain within the country's borders.
- B. Incorrect.
Storing encryption keys in a different country violates the regulation because the encryption keys must also remain within the required country's borders to fully protect PII data.
- C. Correct.
Using BigQuery with a dataset in the required region ensures that the data is processed in compliance with the regulation that requires data to remain within the country.
- D. Incorrect.
A multi-region bucket spans multiple regions, which is not compliant with the regulation requiring data to remain within the country’s borders.
- E. Correct.
VPC Service Controls enhance data security by restricting access to resources within a defined perimeter, helping to ensure compliance with regulatory boundaries.