Your enterprise enforces strict data residency requirements mandating that all compute, storage, and database resources reside exclusively within authorized European regions (europe-west1 and europe-west3) under designated folder hierarchies. As a Cloud DevOps Engineer, you need to establish an automated governance strategy that: Prevents non-compliant infrastructure deployments in the CI/CD pipeline before resources are provisioned in Google Cloud. Continuously detects, reports, and triggers automated remediation for out-of-band geographical resource drift across all organization folders. Which combination of architectural controls should you implement?

Embed `terraform-validator` (or `gcloud beta terraform vet`) with a shared policy library into the Cloud Build pipeline to evaluate Terraform plans against resource location policies; configure Cloud Asset Inventory real-time feeds for resource changes subscribed to a Pub/Sub topic to trigger automated Cloud Functions for drift detection and remediation.: ### What this solution is This approach combines **preventative policy-as-code** validation in continuous integration (shifting left) with **continuous detective and reactive controls** using Cloud Asset Inventory feeds and event-driven automation in Google Cloud. ### How it meets the requirements - **Pre-provisioning blocking**: By running `terraform-validator` or `gcloud beta terraform vet` against compiled Terraform plan files (`tfplan.json`) in **Cloud Build**, the pipeline evaluates proposed infrastructure against declarative Rego or constraint framework policies (such as `constraints/gcp.resourceLocations`). If a resource specifies an unauthorized region, the CI/CD job fails immediately, preventing `terraform apply` from executing. - **Continuous drift detection & remediation**: **Cloud Asset Inventory feeds** monitor organization-level asset creations, updates, and deletions in near real-time. Changes are streamed to **Pub/Sub**, which triggers a serverless **Cloud Function** or **Cloud Run** service. The service inspects the resource's geographic metadata against compliance rules and initiates remediation workflows (e.g., sending findings to Security Command Center or rolling back unapproved out-of-band changes). ### Key advantages - **Shift-Left Security**: Enforces organizational data boundaries during code review and pull requests, saving deployment time and preventing non-compliant resources from ever existing. - **Real-Time Event Processing**: Asset feeds provide instantaneous notification of out-of-band modifications without relying on slow, batch-oriented API polling. - **Separation of Concerns**: Centralizes policy governance in a version-controlled policy library while enabling decoupled, automated remediation. - **Comprehensive Visibility**: Works cohesively with **Assured Workloads** and **Resource Hierarchy Location Restrictions** to enforce end-to-end data residency.

Data Residency Automated Compliance Drift Detection | Professional Cloud DevOps Engineer

Data Residency Automated Compliance Drift Detection

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise enforces strict data residency requirements mandating that all compute, storage, and database resources reside exclusively within authorized European regions (europe-west1 and europe-west3) under designated folder hierarchies.

As a Cloud DevOps Engineer, you need to establish an automated governance strategy that:

Prevents non-compliant infrastructure deployments in the CI/CD pipeline before resources are provisioned in Google Cloud.
Continuously detects, reports, and triggers automated remediation for out-of-band geographical resource drift across all organization folders.

Which combination of architectural controls should you implement?

Embed terraform-validator (or gcloud beta terraform vet) with a shared policy library into the Cloud Build pipeline to evaluate Terraform plans against resource location policies; configure Cloud Asset Inventory real-time feeds for resource changes subscribed to a Pub/Sub topic to trigger automated Cloud Functions for drift detection and remediation.

Embed Binary Authorization attestations on Terraform HCL code repositories in Cloud Build; configure Google Cloud Armor edge security policies across Application Load Balancers to inspect and drop infrastructure API requests originating outside European geographic regions.

Configure an Apigee API proxy with an OASValidation policy to intercept internal Google Cloud console traffic; configure Active Assist Recommender daily scans to flag misconfigured regions in the Cloud Run service list.

Run gcloud asset analyze-iam-policy during the Cloud Build build step to block non-compliant deployments; schedule nightly BigQuery export queries on Cloud Logging audit sinks to alert compliance officers of geographic drift via email.

Professional Cloud DevOps Engineer

Data Residency Automated Compliance Drift Detection

Related questions