An enterprise is designing a data analytics architecture in Google Cloud that must comply with strict local data sovereignty and regulatory residency mandates. The compliance team has established the following requirements: All storage and data processing resources must be strictly confined to a single designated region (europe-west1) and prohibited from using multi-regions. Data at rest in services like BigQuery and Cloud Storage must enforce encryption using Customer-Managed Encryption Keys (CMEK). Key management governance must prevent resources from utilizing cryptographic keys originating from unauthorized projects. BigQuery datasets and their associated Cloud KMS key rings must be colocated in the exact same geographic region. Which set of configuration actions and organization policies should the data engineering team implement to meet these requirements?

Configure the `gcp.resourceLocations` organization policy constraint to allow only `europe-west1`. Apply the `gcp.restrictNonCmekServices` constraint for BigQuery and Cloud Storage, and use `gcp.restrictCmekCryptoKeyProjects` to restrict key provisioning to designated key projects. Create regional BigQuery datasets and Cloud KMS key rings explicitly in `europe-west1`.: ### What the solution is This architecture leverages Google Cloud organization policies alongside regionalized resource provisioning and **Customer-Managed Encryption Keys (CMEK)** in **Cloud KMS** to establish an end-to-end data residency and sovereignty boundary. ### How it meets all requirements - **Confining resources to a single region**: Setting the **`gcp.resourceLocations`** organization policy constraint with `allowedValues` set strictly to `europe-west1` prevents the creation of storage, compute, and analytics resources in any other location, including broader multi-regions (such as `EU`). - **Enforcing CMEK encryption**: The **`gcp.restrictNonCmekServices`** organization policy constraint enforces that services such as `bigquery.googleapis.com` and `storage.googleapis.com` cannot write data using default Google-managed keys, requiring all new at-rest data to use CMEK. - **Governing key projects**: The **`gcp.restrictCmekCryptoKeyProjects`** organization policy restricts which hierarchy nodes (specific projects or folders) are allowed to supply cryptographic keys, preventing unapproved projects from providing CMEK keys. - **Colocating BigQuery datasets and Cloud KMS key rings**: Creating the BigQuery dataset and the Cloud KMS key ring explicitly in `europe-west1` satisfies the cryptographic locality requirement, ensuring keys and encrypted data reside within the same regulatory boundary. ### Key advantages and capabilities - **Preventative enforcement**: Organization policies act as guardrails across the resource hierarchy, blocking non-compliant API resource creation requests immediately. - **Cryptographic control**: Using CMEK allows the enterprise to retain complete ownership over key lifecycles, rotation schedules, and revocation. - **Auditability and compliance**: Centralizing keys in dedicated, approved projects streamlines compliance tracking and Cloud Audit Logs inspection. - **Deterministic data boundaries**: Disallowing multi-region locations eliminates the risk of data being replicated across jurisdictions outside national compliance scopes. ### Why this is optimal Combining granular organization policies (`gcp.resourceLocations`, `gcp.restrictNonCmekServices`, and `gcp.restrictCmekCryptoKeyProjects`) with explicit regional provisioning provides deterministic technical enforcement of data sovereignty, preventing administrative errors or out-of-boundary data dispersion.

Enforce Regional Residency Cmek Org Policies | professional-cloud-data-engineer

Enforce Regional Residency Cmek Org Policies

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a data analytics architecture in Google Cloud that must comply with strict local data sovereignty and regulatory residency mandates. The compliance team has established the following requirements:

All storage and data processing resources must be strictly confined to a single designated region (europe-west1) and prohibited from using multi-regions.
Data at rest in services like BigQuery and Cloud Storage must enforce encryption using Customer-Managed Encryption Keys (CMEK).
Key management governance must prevent resources from utilizing cryptographic keys originating from unauthorized projects.
BigQuery datasets and their associated Cloud KMS key rings must be colocated in the exact same geographic region.

Which set of configuration actions and organization policies should the data engineering team implement to meet these requirements?

Create a BigQuery dataset in europe-west1 and encrypt it using a global Cloud KMS key ring. Apply the gcp.restrictCmekCryptoKeyProjects constraint, and use BigQuery column-level data policies to restrict data residency to local jurisdictions.

Apply the gcp.restrictNonCmekServices organization policy constraint. Create a regional BigQuery dataset in europe-west1, and set up Cloud Data Loss Prevention (Cloud DLP) inspection jobs to automatically migrate out-of-region datasets back to europe-west1.

Configure the gcp.resourceLocations organization policy constraint to allow only europe-west1. Apply the gcp.restrictNonCmekServices constraint for BigQuery and Cloud Storage, and use gcp.restrictCmekCryptoKeyProjects to restrict key provisioning to designated key projects. Create regional BigQuery datasets and Cloud KMS key rings explicitly in europe-west1.

Configure the gcp.resourceLocations organization policy constraint with eu-locations. Create a BigQuery dataset in the EU multi-region, and configure a Cloud KMS key ring located in europe-west1 using gcp.restrictServiceUsage to enforce CMEK.

Professional Cloud Data Engineer

Enforce Regional Residency Cmek Org Policies

Related questions