A financial enterprise operating in the European Union must comply with strict regional data sovereignty and localization mandates. The organization has activated data residency for Security Command Center (SCC) Enterprise tier across its organization hierarchy. The security compliance team mandates the following operational requirements: Security findings, continuous export configurations, BigQuery exports, and mute rules must remain strictly within the EU geographic boundary when at rest, in use, and in transit. Developers and security operations automation must interact with these localized resources programmatically. Security analysts must view and manage these localized findings and configurations via the web interface without data leaving the EU boundary. Which configuration approach should the security engineering team implement to satisfy these data residency requirements?

Direct programmatic requests to regional endpoints using `securitycenter.LOCATION.rep.googleapis.com` and instruct analysts to access the jurisdictional Google Cloud console at `console.eu.cloud.google.com`.: ### What Regional Endpoints and Jurisdictional Consoles Are Google Cloud provides **regional service endpoints** and **jurisdictional web consoles** for services like Security Command Center (SCC) to enforce strict **data residency controls**. When data residency is enabled, specific resource types (including findings, continuous export configurations, BigQuery export configurations, and mute rules) are pinned to a designated geographic boundary. Interacting with these resources requires using dedicated regional API endpoints (such as `securitycenter.LOCATION.rep.googleapis.com`) and jurisdictional console URLs (such as `console.eu.cloud.google.com` or `console.eu.cloud.google` for workforce identity federation). ### How It Meets the Requirements - **Programmatic Interaction with Data Residency:** Directing API calls and automation to `securitycenter.LOCATION.rep.googleapis.com` ensures that requests route directly to the specified EU location, maintaining data residency for resources while in transit and in use. - **Web Console Residency:** Directing console users and analysts to `console.eu.cloud.google.com` guarantees that web UI sessions, queries, and displayed findings remain confined within the European Union jurisdiction. - **Coverage of In-Scope Resources:** This configuration specifically protects findings, continuous exports, BigQuery export configurations, and mute rule definitions, which are governed by data residency controls. ### Key Advantages and Capabilities - **End-to-End Boundary Enforcement:** Guarantees data residency at rest, in transit, and during compute processing. - **Direct Request Routing:** Prevents API calls and administrative sessions from traversing default global control planes. - **Support for Advanced Security Services:** Integrates seamlessly with other regionalized security components such as Google SecOps and Model Armor APIs. - **Audit Compliance:** Provides clear evidence to regulatory auditors that security telemetry and administrative access are physically and logically restricted to the EU. ### Why This Is Optimal Using regional endpoints and the jurisdictional console is the required, native mechanism in Google Cloud for managing data residency-enabled Security Command Center resources. Global default endpoints and the standard console do not route to residency-isolated resources.

Scc Data Residency Regional Endpoints Console | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A financial enterprise hosted on Google Cloud must fulfill stringent data sovereignty and administrative access compliance standards across its resource hierarchy. The organization's security team has established the following requirements: All administrative interactions and maintenance actions performed by Google support personnel on customer resources must be recorded with verified business justification codes. Google personnel must not be granted manual access to customer data or systems without prior, explicit authorization from the enterprise's designated approval team. The enterprise must retain cryptographic control to deny Google the ability to decrypt sensitive data during support interventions, making the enterprise the ultimate arbiter of access. Which combination of Google Cloud security controls and access governance services meets these requirements?

Configuring security controls within cloud environments to support compliance requirements (e.g., Assured Workloads, organizational policies, Access Transparency, Access Approval, regionalization of data and services).

AdvancedProfessional Cloud Security Engineer

A healthcare enterprise configures an Assured Workloads folder using the US Data Boundary for Healthcare and Life Sciences control package to maintain HIPAA compliance. An engineering team requires a Google Cloud service that is covered under Google Cloud's HIPAA Business Associate Agreement (BAA) and supports US data residency and CMEK, but is not included in the control package's default service list. A cloud security engineer updates the gcp.restrictServiceUsage organization policy constraint on the folder to allow the service. Following this change, Assured Workloads continuous monitoring flags compliance violations on the modified resources. What action should the security engineer take to resolve the continuous monitoring alerts while maintaining a compliant posture?

AdvancedProfessional Cloud Security Engineer

An enterprise organization stores database credentials in Google Cloud Secret Manager. The security team must implement continuous credential hygiene for these database secrets according to the following requirements: The credentials must be automatically rotated on a recurring 30-day schedule without microservice downtime. Secret Manager must emit events to trigger an automated rotation handler service when a rotation is due. The rotation service must generate a new credential, apply it to the database, add a new secret version to Secret Manager, validate application health, and disable the superseded secret version. The architecture must follow Google Cloud least-privilege security best practices for service integration. Which workflow and architectural configuration should the security engineer implement?

AdvancedProfessional Cloud Security Engineer

A security engineer needs to configure access for an engineer (developer@example.com) who must generate short-lived OAuth 2.0 access tokens to impersonate a specific deployment service account (deploy-prod@example-proj.iam.gserviceaccount.com) from their local environment. The project contains multiple sensitive service accounts used by critical infrastructure. To uphold the principle of least privilege and prevent unintentional privilege escalation, how should the security engineer grant the necessary access?

AdvancedProfessional Cloud Security Engineer

A security engineer is designing an egress perimeter control architecture for Google Cloud workloads located in a VPC across multiple zones. The organization requires Layer 7 traffic inspection to filter outbound HTTP and HTTPS connections based on domain matcher strings and TLS Server Name Indication (SNI), applying custom block or allow actions. Which combination of components and configuration steps should the engineer implement to meet these requirements?

AdvancedProfessional Cloud Data Engineer

An enterprise is operating BigQuery on the Enterprise edition across several departments. The data engineering team manages a multi-tenant environment with the following workload requirements: ETL/ELT pipeline jobs: Require strictly guaranteed execution times and predictable slot allocation without interference or unexpected queue delays. Ad-hoc data analyst queries: Experience unpredictable traffic bursts during business hours, but can tolerate idle resource sharing to minimize costs. Which configuration strategy should the team implement across their reservations to satisfy these workload requirements while optimizing cost?

Professional Cloud Security Engineer

Scc Data Residency Regional Endpoints Console

Related questions