Your financial enterprise processes sensitive customer transaction records subject to strict European Union data residency and sovereignty regulations. The compliance policy mandates the following requirements: All data stored at rest in Cloud Storage must be encrypted using Customer-Managed Encryption Keys (CMEK). Key management cryptographic material and operations must reside exclusively within the europe-west3 (Frankfurt) region. Data processing pipelines running on Cloud Dataflow must execute workers exclusively within europe-west3, while maintaining resilience against potential single-zone capacity constraints or outages. No cross-region network egress or unapproved resource location provisioning is permitted. How should you configure the architecture to enforce compliance and data sovereignty while ensuring job execution resilience?

Create Cloud Storage buckets and a Cloud KMS key ring with keys in the regional location `europe-west3`. Enforce the `gcp.resourceLocations` organization policy for `europe-west3`. Launch the Dataflow job specifying `--region=europe-west3` without setting the `--zone` parameter.: ### What the solution is This architecture establishes strict regional **data residency** and **governance controls** using location-bound **Cloud KMS** keys, organization policy constraints, and **Cloud Dataflow regional job execution**. ### How it meets the requirements - **Enforcing CMEK per region**: Regional storage resources must use a CMEK key ring and key located in the exact same region. Creating the Cloud KMS key ring in `europe-west3` satisfies data sovereignty and complies with CMEK location constraints. - **Preventing cross-region egress and unapproved locations**: Enforcing the **`gcp.resourceLocations`** organization policy constraint restricted to `europe-west3` guarantees that no storage, compute, or cryptographic resources can be provisioned outside the authorized boundary. - **Ensuring execution resilience without violating residency**: Submitting the Dataflow pipeline with `--region=europe-west3` and omitting the `--zone` flag directs Dataflow to route worker VMs dynamically across any healthy zone strictly within `europe-west3` based on availability, ensuring resilience against zonal failures while maintaining geographic containment. ### Key advantages - **Automated Zonal Failover**: Eliminating explicit zonal pinning allows Dataflow's control plane to select optimal zones within `europe-west3`. - **Strict Cryptographic Locality**: Keys cannot be exported or moved outside the designated `europe-west3` regional boundary. - **Governance Guardrails**: The organization policy prevents accidental deployment of resources across regional borders. ### Why this is optimal This approach directly satisfies EU regulatory data boundaries and CMEK requirements while leveraging regional elasticity for fault tolerance.

Dataflow Residency Cmek Kms Regional Execution | professional-cloud-data-engineer

Dataflow Residency Cmek Kms Regional Execution

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your financial enterprise processes sensitive customer transaction records subject to strict European Union data residency and sovereignty regulations. The compliance policy mandates the following requirements:

All data stored at rest in Cloud Storage must be encrypted using Customer-Managed Encryption Keys (CMEK).
Key management cryptographic material and operations must reside exclusively within the europe-west3 (Frankfurt) region.
Data processing pipelines running on Cloud Dataflow must execute workers exclusively within europe-west3, while maintaining resilience against potential single-zone capacity constraints or outages.
No cross-region network egress or unapproved resource location provisioning is permitted.

How should you configure the architecture to enforce compliance and data sovereignty while ensuring job execution resilience?

Create Cloud Storage buckets and a Cloud KMS key ring with keys in the regional location europe-west3. Enforce the gcp.resourceLocations organization policy for europe-west3. Launch the Dataflow job specifying --region=europe-west3 without setting the --zone parameter.

Create Cloud Storage buckets in europe-west3 and generate Cloud KMS keys in the europe multi-region location. Launch the Dataflow job specifying --region=europe-west3 and an explicit --zone=europe-west3-a parameter.

Create Cloud Storage buckets in europe-west3 and provision Cloud KMS keys in the global location. Launch the Dataflow pipeline specifying --region=europe-west3 and configure Dataflow workers to execute in europe-west1.

Create Cloud Storage buckets in europe-west3 and generate Cloud KMS keys in europe-west3. Enforce the gcp.restrictNonCmekServices constraint, and execute Dataflow jobs by setting --zone=europe-west3-b while omitting the --region flag.

Professional Cloud Data Engineer

Dataflow Residency Cmek Kms Regional Execution

Related questions