An organization is establishing a secure cloud data warehouse architecture on Google Cloud. Corporate compliance policies mandate strict data governance, data residency, and cryptographic controls across all projects: No storage or analytics service may be created using Google default encryption; all new resources must enforce Customer-Managed Encryption Keys (CMEK). All CMEKs must originate strictly from a centralized, audited security project. Data residency rules require all encryption keys and storage resources to align in the same regional location. Service identities must operate under the principle of least privilege to perform cryptographic operations. Which combination of Google Cloud controls should the data engineering team implement to satisfy these requirements?

Enforce organization policies constraints/gcp.restrictNonCmekServices and constraints/gcp.restrictCmekCryptoKeyProjects, provision Cloud KMS keys in the matching region within the centralized security project, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the respective service agents.: ### What This Solution Is This solution implements **Google Cloud Organization Policies** combined with **Cloud Key Management Service (Cloud KMS)** access control to create an end-to-end governance and cryptographic enforcement framework for analytical workloads. ### How It Meets the Requirements - **Prevent non-CMEK resources**: Enforcing the `constraints/gcp.restrictNonCmekServices` constraint at the organization or folder level denies the creation of services or buckets unless they specify a customer-managed encryption key. - **Restrict key origins to a centralized project**: Applying the `constraints/gcp.restrictCmekCryptoKeyProjects` constraint restricts the resource hierarchy so services can only consume Cloud KMS crypto keys originating from the authorized security project. - **Data residency**: Creating the **Cloud KMS key rings and symmetric keys** within the exact regional location matching the analytical storage resources satisfies regional data sovereignty requirements. - **Least privilege access**: Granting the predefined IAM role **Cloud KMS CryptoKey Encrypter/Decrypter** (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) directly to the Google-managed **service agent** gives it the exact permissions required to encrypt and decrypt data at rest on behalf of the service. ### Key Advantages - **Automated governance**: Prevents human error by automatically blocking non-compliant, unencrypted resource deployments. - **Centralized auditability**: Centralizes key life-cycle management, key rotation schedules, and cryptographic access logs in a dedicated security project. - **Strict compliance**: Guarantees cryptographic boundaries and regional data residency constraints across all cloud storage and data warehouse assets. ### Why This Is Optimal Organization policies provide declarative guardrails that prevent non-compliant infrastructure provisioning before it starts, while assigning the Encrypter/Decrypter role directly to service agents ensures seamless background decryption without granting broad administrative permissions.

Enforce Cmek Governance Organization Policies | professional-cloud-data-engineer

Enforce Cmek Governance Organization Policies

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is establishing a secure cloud data warehouse architecture on Google Cloud. Corporate compliance policies mandate strict data governance, data residency, and cryptographic controls across all projects:

No storage or analytics service may be created using Google default encryption; all new resources must enforce Customer-Managed Encryption Keys (CMEK).
All CMEKs must originate strictly from a centralized, audited security project.
Data residency rules require all encryption keys and storage resources to align in the same regional location.
Service identities must operate under the principle of least privilege to perform cryptographic operations.

Which combination of Google Cloud controls should the data engineering team implement to satisfy these requirements?

Enforce VPC Service Controls around each workload project, create regional Cloud KMS keys in the local data warehouse projects, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role to individual data analysts.

Configure constraints/gcp.restrictCmekCryptoKeyProjects across all projects, export analytical data to Google-managed encrypted tables, and assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the compute service accounts.

Enforce organization policies constraints/gcp.restrictNonCmekServices and constraints/gcp.restrictCmekCryptoKeyProjects, provision Cloud KMS keys in the matching region within the centralized security project, and grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the respective service agents.

Grant the Cloud KMS Admin role to the project service agents, enforce constraints/gcp.restrictNonCmekServices, and create a single global Cloud KMS key ring in the centralized security project to manage keys across all regions.

Professional Cloud Data Engineer

Enforce Cmek Governance Organization Policies

Related questions