A financial enterprise is designing a centralized analytics platform on Google Cloud using BigQuery to process sensitive customer financial records. The solution must adhere to strict regulatory, compliance, and governance non-functional requirements: Data Residency: Data assets must be strictly restricted to create and store datasets within the europe-west3 (Frankfurt) region. Encryption Standards: Regulatory mandates require cryptographic keys to be protected within FIPS 140-2 Level 3 validated hardware security modules that the enterprise controls. Access Perimeter: Access to the analytical environment must be strictly restricted based on authorized client geographic locations and protected against data exfiltration. Which architectural combination should you implement to satisfy these compliance requirements?

Apply an Organization Policy with the resource locations constraint set to `europe-west3`, configure BigQuery with Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, and protect the project with a VPC Service Controls perimeter using an Access Context Manager policy.: ### What this architectural combination is This architecture combines Google Cloud's foundational governance, cryptographic, and perimeter security services to establish strict compliance boundaries. It enforces **Organization Policy Service constraints**, **Cloud Key Management Service (Cloud KMS) with Cloud HSM**, and **VPC Service Controls** paired with **Access Context Manager**. ### How it meets the requirements - **Data Residency (`europe-west3`):** The `gcp.resourceLocations` Organization Policy constraint restricts resource deployment at the organization, folder, or project level. It prevents administrators and automated pipelines from creating BigQuery datasets or storage infrastructure outside `europe-west3`. - **Encryption Standards (FIPS 140-2 Level 3):** Customer-Managed Encryption Keys (**CMEK**) using Cloud KMS backed by **Cloud HSM** (Hardware Security Modules) provide FIPS 140-2 Level 3 validated cryptographic protection. This allows the organization to control key lifecycle, rotation, and access while meeting rigorous financial audit mandates. - **Access Perimeter and Exfiltration Prevention:** **VPC Service Controls** creates a secure boundary around sensitive services like BigQuery. **Access Context Manager** defines contextual attributes (such as geographic region and IP subnet) to restrict client ingress, while the service perimeter blocks unauthorized exfiltration of sensitive data outside the boundary. ### Key advantages - **Declarative Governance:** Organization policies prevent non-compliant resource creation proactively rather than relying on reactive detection. - **Hardware Security:** Cloud HSM keys are non-exportable and operate strictly within certified hardware security modules. - **Multi-layered Defense:** Combines cryptographic control (CMEK) with context-aware network boundary isolation (VPC-SC). - **Audit Alignment:** Directly satisfies financial cloud data management controls (such as CDMC guidelines). ### Why this is optimal This solution enforces mandatory compliance controls natively at the infrastructure and platform layers without requiring custom code or application-level cryptographic middleware.

StudyCerts

Bigquery Compliance Data Residency Cmek Hsm | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Bigquery Compliance Data Residency Cmek Hsm

Section: Identifying functional and non-functional requirements

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing a centralized analytics platform on Google Cloud using BigQuery to process sensitive customer financial records. The solution must adhere to strict regulatory, compliance, and governance non-functional requirements:

Data Residency: Data assets must be strictly restricted to create and store datasets within the europe-west3 (Frankfurt) region.
Encryption Standards: Regulatory mandates require cryptographic keys to be protected within FIPS 140-2 Level 3 validated hardware security modules that the enterprise controls.
Access Perimeter: Access to the analytical environment must be strictly restricted based on authorized client geographic locations and protected against data exfiltration.

Which architectural combination should you implement to satisfy these compliance requirements?

Implement application-level client-side envelope encryption, configure Data Catalog tag templates with approved location tags, and assign IAM storage and BigQuery roles without service perimeters.

Apply an Organization Policy with the resource locations constraint set to europe-west3, configure BigQuery with Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, and protect the project with a VPC Service Controls perimeter using an Access Context Manager policy.

Configure Cloud External Key Manager (Cloud EKM) with software keys, apply IAM condition policies based on request location, and deploy Cloud Armor security policies directly in front of the BigQuery storage API.

Rely on Google Cloud's default Google-managed encryption keys, restrict BigQuery dataset regional locations in dataset DDL creation scripts, and deploy VPC firewall rules with IP egress filters on compute instances.

Professional Cloud Architect

Bigquery Compliance Data Residency Cmek Hsm

Related questions