Dataproc Regional Cmek Sovereignty Perimeter

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise is building a big data analytics pipeline on Google Cloud to process regulated healthcare data subject to strict data sovereignty laws in Germany. The compliance mandates require that all compute execution, key material, and at-rest storage remain strictly localized within the europe-west3 (Frankfurt) region, with controls in place to prevent data exfiltration.

You need to architect the Dataproc infrastructure, Customer-Managed Encryption Keys (CMEK), and perimeter security to enforce these data sovereignty requirements.

Which configuration should you deploy?

Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to the Compute Engine, Cloud Storage, and Dataproc service agents; create an europe-west3 CMEK-encrypted staging bucket; create the Dataproc cluster in europe-west3 specifying the --kms-key and --bucket flags; and secure the projects within a VPC Service Controls perimeter enclosing Cloud KMS, Dataproc, Compute Engine, and Cloud Storage

Create a dual-region Cloud KMS key ring in the europe-west4 and europe-west1 locations; assign the CryptoKey Admin role to the Dataproc VM default service account; deploy the Dataproc cluster using default staging buckets; and rely on standard Cloud IAM policies for egress control

Create a Cloud KMS key in the global region; grant the CryptoKey Encrypter/Decrypter role to the Dataproc service agent only; instantiate the Dataproc cluster in europe-west3 with --gce-pd-kms-key; and enable VPC Flow Logs for exfiltration monitoring

Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to all human data engineers; deploy the Dataproc cluster using the --kms-key and --gce-pd-kms-key flags simultaneously; and create a VPC firewall rule blocking external IP traffic

Professional Cloud Data Engineer

Dataproc Regional Cmek Sovereignty Perimeter

Related questions