professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A multinational enterprise is building a big data analytics pipeline on Google Cloud to process regulated healthcare data subject to strict data sovereignty laws in Germany. The compliance mandates require that all compute execution, key material, and at-rest storage remain strictly localized within the europe-west3 (Frankfurt) region, with controls in place to prevent data exfiltration.
You need to architect the Dataproc infrastructure, Customer-Managed Encryption Keys (CMEK), and perimeter security to enforce these data sovereignty requirements.
Which configuration should you deploy?
This architecture establishes an end-to-end regional data processing boundary by combining localized Cloud Key Management Service (Cloud KMS) Customer-Managed Encryption Keys (CMEK), regional Dataproc compute resources, and a VPC Service Controls service perimeter.
StudyCerts
StudyCertseurope-west3 region guarantees that the cryptographic key material is created, stored, and processed solely within that specific geographic location, meeting sovereign data residency mandates.roles/cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine, Cloud Storage, and Dataproc service agents enables full cryptographic access across all stages of processing. Using --kms-key on the Dataproc cluster encrypts the persistent disks and submitted job arguments, while the --bucket flag specifies a dedicated Cloud Storage staging bucket encrypted with the regional CMEK.europe-west3).Google Cloud requires CMEK keys to reside in the exact same region as the underlying resources they protect. Provisioning single-region keys in europe-west3 alongside matching regional Dataproc clusters and staging buckets ensures complete functional compatibility and strict compliance with territorial data residency laws.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.