An enterprise is deploying an AI agent solution built on the Gemini platform on Google Cloud. The architecture processes real-time user prompts, retrieves context from backend storage, and persists conversation history and model outputs. The security team mandates the following compliance and data governance requirements: Data Residency and Sovereignty: All prompt inputs, model outputs, and training datasets (at rest, in use, and in transit) must strictly remain within the europe-west1 region and be prevented from crossing virtual network boundaries. In-flight Data Governance: Sensitive data within user prompts and agent responses must be classified and de-identified synchronously in real time before persistence. Cryptographic Control: All stored data must be encrypted with Customer-Managed Encryption Keys (CMEK) rooted in the same geographic region. Which combination of security controls should the security engineer implement?

Configure real-time prompt and output sanitization using the Cloud DLP synchronous `content.deidentify` method targeting the `dlp.europe-west1.rep.googleapis.com` regional endpoint; enforce the `constraints/gcp.restrictEndpointUsage` and `constraints/gcp.resourceLocations` organization policies; enclose services within a VPC Service Controls perimeter; and configure CMEK using Cloud KMS keys created in `europe-west1`.: ### What the solution is This architecture combines **Sensitive Data Protection (Cloud DLP)** regional endpoints, **VPC Service Controls**, **Cloud KMS**, and **Organization Policy Service** constraints to establish end-to-end data governance, strict data residency, and encryption for AI workloads. ### How it meets all requirements - **In-flight Data Governance**: The synchronous `content.deidentify` API method of Cloud DLP inspects and de-identifies prompt strings and model responses in real time before data reaches persistent backend storage. - **Data Residency and In-Transit Sovereignty**: Calling the regional endpoint `dlp.europe-west1.rep.googleapis.com` ensures that TLS sessions terminate inside `europe-west1`, guaranteeing that data at rest, in use, and in transit never leaves the specified region. Enforcing `constraints/gcp.restrictEndpointUsage` prevents client calls from accidentally routing to global endpoints. - **Resource Location Enforcement**: Enforcing `constraints/gcp.resourceLocations` limits resource provisioning strictly to `europe-west1` across all projects. - **Perimeter Isolation**: **VPC Service Controls** defines a security perimeter around storage, AI APIs, and database services, preventing unauthorized exfiltration and ingress across project boundaries. - **Cryptographic Control**: CMEK keys provisioned via **Cloud KMS** in `europe-west1` wrap local data encryption keys (DEKs) ensuring full customer control over encryption at rest. ### Key advantages and capabilities - **Zero Regional Spillover**: Regional API endpoints prevent traffic from terminating at Google's global points of presence outside the sovereign boundary. - **Synchronous Protection**: Inline masking with `content` methods sanitizes generative AI inputs and outputs before storage. - **Defense-in-Depth**: Combines network perimeters (VPC-SC), resource placement constraints, cryptographic controls (CMEK), and payload inspection.

Gemini Ai Governance Residency Protection | Professional Cloud Security Engineer

Gemini Ai Governance Residency Protection

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying an AI agent solution built on the Gemini platform on Google Cloud. The architecture processes real-time user prompts, retrieves context from backend storage, and persists conversation history and model outputs.

The security team mandates the following compliance and data governance requirements:

Data Residency and Sovereignty: All prompt inputs, model outputs, and training datasets (at rest, in use, and in transit) must strictly remain within the europe-west1 region and be prevented from crossing virtual network boundaries.
In-flight Data Governance: Sensitive data within user prompts and agent responses must be classified and de-identified synchronously in real time before persistence.
Cryptographic Control: All stored data must be encrypted with Customer-Managed Encryption Keys (CMEK) rooted in the same geographic region.

Which combination of security controls should the security engineer implement?

Call the global Cloud DLP endpoint with the location parameter set to locations/europe-west1/content:deidentify; apply the constraints/gcp.resourceLocations organization policy; configure default Google-managed encryption keys; and rely on Cloud Armor WAF rules to restrict API egress across regions.

Implement Private Services Access with VPC Network Peering to access AI APIs; apply Cloud Storage Bucket Lock policies to prevent modification; and generate asymmetric signing keys in Cloud KMS to de-identify prompt payloads.

Configure real-time prompt and output sanitization using the Cloud DLP synchronous content.deidentify method targeting the dlp.europe-west1.rep.googleapis.com regional endpoint; enforce the constraints/gcp.restrictEndpointUsage and constraints/gcp.resourceLocations organization policies; enclose services within a VPC Service Controls perimeter; and configure CMEK using Cloud KMS keys created in europe-west1.

Configure asynchronous Cloud DLP scheduled inspection job triggers on backend Cloud Storage buckets; enable Cloud KMS Autokey in multi-region europe; and use Serverless VPC Access connectors without VPC Service Controls perimeters.

Professional Cloud Security Engineer

Gemini Ai Governance Residency Protection

Related questions