A healthcare provider is designing an analytics data pipeline on Google Cloud to process electronic health records containing Protected Health Information (PHI) and Personally Identifiable Information (PII). The platform must comply with HIPAA and GDPR requirements. The compliance architecture must satisfy the following criteria: Automatically discover, classify, and de-identify sensitive patient identifiers during the ingestion pipeline. Enforce strict geographic boundaries so that data at rest and compute resources remain within permitted jurisdictions. Mitigate the risk of unauthorized data movement and exfiltration from Google-managed storage and analytics services. Which combination of Google Cloud controls should the organization implement?

Use Sensitive Data Protection to inspect and de-identify sensitive data, apply Resource Location Organization Policies to restrict deployment regions, and configure VPC Service Controls perimeters around storage and analytics services.: What the Recommended Architecture Is This architecture combines Sensitive Data Protection (formerly Cloud DLP), Resource Location Organization Policies, and VPC Service Controls to establish a defense-in-depth security and compliance baseline for sensitive workloads governed by HIPAA and GDPR. How It Meets the Requirements Discover, classify, and de-identify sensitive data: Sensitive Data Protection provides automated discovery, classification using built-in or custom infoTypes, and robust de-identification techniques such as tokenization, masking, and cryptographic hashing during the ingestion pipeline. Enforce geographic boundaries: Resource Location Organization Policies (constraints/gcp.resourceLocations) define explicit geographic constraints at the organization, folder, or project level, preventing users from creating cloud resources and storing data outside compliant regions. Mitigate data exfiltration: VPC Service Controls establishes secure network perimeters around multi-tenant Google-managed services like Cloud Storage and BigQuery, preventing unauthorized data transfer, copying, or egress to external unauthorized projects or untrusted networks. Key Advantages and Capabilities Automated PII/PHI Discovery: Inspects both structured and unstructured payloads automatically without requiring manual tagging. Strict Residency Governance: Guarantees centralized enforcement of data residency laws without relying solely on developer discipline. Context-Aware Perimeter Security: Enforces access boundaries based on client IP, identity, and service perimeter membership. Regulatory Alignment: Directly addresses HIPAA Technical Safeguards and GDPR privacy-by-design mandates. Why This Is Optimal This solution leverages native, enterprise-grade Google Cloud governance and security mechanisms designed specifically to address data privacy, residency, and exfiltration prevention systematically across all layers of the cloud environment.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Hipaa Gdpr Data Protection Compliance Controls

Section: Legislation and regulation (e.g., health record privacy, children's privacy, data privacy, ownership, and data sovereignty)

A healthcare provider is designing an analytics data pipeline on Google Cloud to process electronic health records containing Protected Health Information (PHI) and Personally Identifiable Information (PII). The platform must comply with HIPAA and GDPR requirements.

The compliance architecture must satisfy the following criteria:

Automatically discover, classify, and de-identify sensitive patient identifiers during the ingestion pipeline.
Enforce strict geographic boundaries so that data at rest and compute resources remain within permitted jurisdictions.
Mitigate the risk of unauthorized data movement and exfiltration from Google-managed storage and analytics services.

Which combination of Google Cloud controls should the organization implement?

Use Secret Manager to tokenize and de-identify database records, configure BigQuery authorized views across external regions, and enable uniform bucket-level access on Cloud Storage.

Use Google Cloud Armor security policies to tokenize incoming application payloads, define Identity and Access Management (IAM) conditions for regional scoping, and enable Firewall Rules Logging to block data exfiltration.

Use Binary Authorization to parse and mask data during ingestion, implement Cloud NAT to restrict outbound internet routing, and enable Cloud KMS with default Google-managed keys.

Use Sensitive Data Protection to inspect and de-identify sensitive data, apply Resource Location Organization Policies to restrict deployment regions, and configure VPC Service Controls perimeters around storage and analytics services.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Hipaa Gdpr Data Protection Compliance Controls

Section: Legislation and regulation (e.g., health record privacy, children's privacy, data privacy, ownership, and data sovereignty)

The compliance architecture must satisfy the following criteria:

Automatically discover, classify, and de-identify sensitive patient identifiers during the ingestion pipeline.
Enforce strict geographic boundaries so that data at rest and compute resources remain within permitted jurisdictions.
Mitigate the risk of unauthorized data movement and exfiltration from Google-managed storage and analytics services.

Which combination of Google Cloud controls should the organization implement?

Use Secret Manager to tokenize and de-identify database records, configure BigQuery authorized views across external regions, and enable uniform bucket-level access on Cloud Storage.

Use Binary Authorization to parse and mask data during ingestion, implement Cloud NAT to restrict outbound internet routing, and enable Cloud KMS with default Google-managed keys.

Explanations

What the Recommended Architecture Is

This architecture combines Sensitive Data Protection (formerly Cloud DLP), Resource Location Organization Policies, and VPC Service Controls to establish a defense-in-depth security and compliance baseline for sensitive workloads governed by HIPAA and GDPR.

How It Meets the Requirements

Discover, classify, and de-identify sensitive data: Sensitive Data Protection provides automated discovery, classification using built-in or custom infoTypes, and robust de-identification techniques such as tokenization, masking, and cryptographic hashing during the ingestion pipeline.
Enforce geographic boundaries: Resource Location Organization Policies (constraints/gcp.resourceLocations) define explicit geographic constraints at the organization, folder, or project level, preventing users from creating cloud resources and storing data outside compliant regions.
Mitigate data exfiltration: VPC Service Controls establishes secure network perimeters around multi-tenant Google-managed services like Cloud Storage and BigQuery, preventing unauthorized data transfer, copying, or egress to external unauthorized projects or untrusted networks.

Key Advantages and Capabilities

Automated PII/PHI Discovery: Inspects both structured and unstructured payloads automatically without requiring manual tagging.
Strict Residency Governance: Guarantees centralized enforcement of data residency laws without relying solely on developer discipline.
Context-Aware Perimeter Security: Enforces access boundaries based on client IP, identity, and service perimeter membership.
Regulatory Alignment: Directly addresses HIPAA Technical Safeguards and GDPR privacy-by-design mandates.

Why This Is Optimal

This solution leverages native, enterprise-grade Google Cloud governance and security mechanisms designed specifically to address data privacy, residency, and exfiltration prevention systematically across all layers of the cloud environment.

View source documentation

Professional Cloud Architect

Hipaa Gdpr Data Protection Compliance Controls

Professional Cloud Architect

Hipaa Gdpr Data Protection Compliance Controls

What the Recommended Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Monolith to Microservices on GKE with HPA