A financial services organization is designing a cloud architecture on Google Cloud to handle sensitive customer service interactions and logging data. The company is subject to strict European regulatory frameworks governing data residency, sovereignty, and cross-border transfers. The compliance mandate requires: Enforcement across all projects in the organization hierarchy preventing any compute, storage, or AI service resources from being deployed outside of European geographic boundaries. Directing all client and REST API interactions to dedicated regional endpoints rather than default global routing endpoints to guarantee that request payloads are processed exclusively within the designated jurisdiction. Ensuring all application logs and operational telemetry remain confined within the regional boundary. Which combination of architectural controls should you implement to meet these requirements?

Enforce the Resource Location Restriction organization policy (`constraints/gcp.resourceLocations`) set to `in:europe-locations`, and configure application client API calls to use regional service endpoints (e.g., `[region-id]-[service].googleapis.com`) with regionalized log buckets.: What the Solution Is The combination of Google Cloud Organization Policy constraints and regional service endpoints provides centralized governance and strict enforcement of data residency, locality, and sovereignty mandates. How it Meets the Requirements Enforcing Resource Boundaries: The constraints/gcp.resourceLocations organization policy constraint acts as a preventative guardrail across the entire resource hierarchy (organization, folder, or project level). By configuring it to allow only in:europe-locations, Google Cloud automatically blocks developers and automated pipelines from creating non-compliant resources (such as VMs, Cloud Storage buckets, or AI agents) outside European data centers. Regional API Processing: Directing API requests to regionalized hostnames (such as [region-id]-[service].googleapis.com) guarantees that the control plane and data plane processing remain strictly within that specific region, avoiding the global default endpoint routing which might terminate or inspect traffic in other jurisdictions. Log Residency: Storing logs in localized regional log buckets ensures that audit records and interaction transcripts never leave the chosen geographic perimeter. Key Advantages and Capabilities Centralized Guardrails: Prevents accidental or intentional provisioning of out-of-region resources without requiring per-user IAM maintenance. Regulatory Compliance: Directly addresses legal mandates such as GDPR and jurisdictional data sovereignty rules that forbid extraterritorial data handling. Deterministic Request Path: Regional hostnames ensure payload data in transit is handled by regional infrastructure rather than global Anycast frontend routers. Auditability: Simplifies compliance audits by maintaining clear geographic isolation of data at rest and data in transit. Why This Is Optimal This approach provides comprehensive, end-to-end enforcement at both the infrastructure provisioning layer (Organization Policies) and the operational data processing layer (regional endpoints and regional storage), satisfying compliance mandates without modifying individual application authorization models.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Data Residency Sovereignty Resource Locations Regional Endpoints

Section: Legislation and regulation (e.g., health record privacy, children's privacy, data privacy, ownership, and data sovereignty)

A financial services organization is designing a cloud architecture on Google Cloud to handle sensitive customer service interactions and logging data. The company is subject to strict European regulatory frameworks governing data residency, sovereignty, and cross-border transfers.

The compliance mandate requires:

Enforcement across all projects in the organization hierarchy preventing any compute, storage, or AI service resources from being deployed outside of European geographic boundaries.
Directing all client and REST API interactions to dedicated regional endpoints rather than default global routing endpoints to guarantee that request payloads are processed exclusively within the designated jurisdiction.
Ensuring all application logs and operational telemetry remain confined within the regional boundary.

Which combination of architectural controls should you implement to meet these requirements?

Apply IAM Conditions on all developer and service account roles denying requests where the resource creation request originates outside Europe, and route all API calls through a global external Application Load Balancer.

Enforce the Resource Location Restriction organization policy (constraints/gcp.resourceLocations) set to in:europe-locations, and configure application client API calls to use regional service endpoints (e.g., [region-id]-[service].googleapis.com) with regionalized log buckets.

Configure VPC Firewall rules to block all egress traffic to non-European IP ranges, and rely on default global service hostnames for API access.

Enable default Google-managed encryption keys on all Cloud Storage buckets, and use Cloud Monitoring workspace metrics to track cross-project resource creation.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Data Residency Sovereignty Resource Locations Regional Endpoints

Section: Legislation and regulation (e.g., health record privacy, children's privacy, data privacy, ownership, and data sovereignty)

The compliance mandate requires:

Enforcement across all projects in the organization hierarchy preventing any compute, storage, or AI service resources from being deployed outside of European geographic boundaries.
Directing all client and REST API interactions to dedicated regional endpoints rather than default global routing endpoints to guarantee that request payloads are processed exclusively within the designated jurisdiction.
Ensuring all application logs and operational telemetry remain confined within the regional boundary.

Which combination of architectural controls should you implement to meet these requirements?

Configure VPC Firewall rules to block all egress traffic to non-European IP ranges, and rely on default global service hostnames for API access.

Enable default Google-managed encryption keys on all Cloud Storage buckets, and use Cloud Monitoring workspace metrics to track cross-project resource creation.

Explanations

What the Solution Is

The combination of Google Cloud Organization Policy constraints and regional service endpoints provides centralized governance and strict enforcement of data residency, locality, and sovereignty mandates.

How it Meets the Requirements

Enforcing Resource Boundaries: The constraints/gcp.resourceLocations organization policy constraint acts as a preventative guardrail across the entire resource hierarchy (organization, folder, or project level). By configuring it to allow only in:europe-locations, Google Cloud automatically blocks developers and automated pipelines from creating non-compliant resources (such as VMs, Cloud Storage buckets, or AI agents) outside European data centers.
Regional API Processing: Directing API requests to regionalized hostnames (such as [region-id]-[service].googleapis.com) guarantees that the control plane and data plane processing remain strictly within that specific region, avoiding the global default endpoint routing which might terminate or inspect traffic in other jurisdictions.
Log Residency: Storing logs in localized regional log buckets ensures that audit records and interaction transcripts never leave the chosen geographic perimeter.

Key Advantages and Capabilities

Centralized Guardrails: Prevents accidental or intentional provisioning of out-of-region resources without requiring per-user IAM maintenance.
Regulatory Compliance: Directly addresses legal mandates such as GDPR and jurisdictional data sovereignty rules that forbid extraterritorial data handling.
Deterministic Request Path: Regional hostnames ensure payload data in transit is handled by regional infrastructure rather than global Anycast frontend routers.
Auditability: Simplifies compliance audits by maintaining clear geographic isolation of data at rest and data in transit.

Why This Is Optimal

This approach provides comprehensive, end-to-end enforcement at both the infrastructure provisioning layer (Organization Policies) and the operational data processing layer (regional endpoints and regional storage), satisfying compliance mandates without modifying individual application authorization models.

View source documentation

Professional Cloud Architect

Data Residency Sovereignty Resource Locations Regional Endpoints

Professional Cloud Architect

Data Residency Sovereignty Resource Locations Regional Endpoints

What the Solution Is

How it Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Compute Engine Instance Availability Policy