professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A multinational enterprise is building a big data analytics pipeline on Google Cloud to process regulated healthcare data subject to strict data sovereignty laws in Germany. The compliance mandates require that all compute execution, key material, and at-rest storage remain strictly localized within the europe-west3 (Frankfurt) region, with controls in place to prevent data exfiltration.
You need to architect the Dataproc infrastructure, Customer-Managed Encryption Keys (CMEK), and perimeter security to enforce these data sovereignty requirements.
Which configuration should you deploy?
Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to all human data engineers; deploy the Dataproc cluster using the --kms-key and --gce-pd-kms-key flags simultaneously; and create a VPC firewall rule blocking external IP traffic
Create a Cloud KMS key in the global region; grant the CryptoKey Encrypter/Decrypter role to the Dataproc service agent only; instantiate the Dataproc cluster in europe-west3 with --gce-pd-kms-key; and enable VPC Flow Logs for exfiltration monitoring
Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to the Compute Engine, Cloud Storage, and Dataproc service agents; create an europe-west3 CMEK-encrypted staging bucket; create the Dataproc cluster in europe-west3 specifying the --kms-key and --bucket flags; and secure the projects within a VPC Service Controls perimeter enclosing Cloud KMS, Dataproc, Compute Engine, and Cloud Storage
Create a dual-region Cloud KMS key ring in the europe-west4 and europe-west1 locations; assign the CryptoKey Admin role to the Dataproc VM default service account; deploy the Dataproc cluster using default staging buckets; and rely on standard Cloud IAM policies for egress control
Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to all human data engineers; deploy the Dataproc cluster using the --kms-key and --gce-pd-kms-key flags simultaneously; and create a VPC firewall rule blocking external IP traffic
Create a Cloud KMS key in the global region; grant the CryptoKey Encrypter/Decrypter role to the Dataproc service agent only; instantiate the Dataproc cluster in europe-west3 with --gce-pd-kms-key; and enable VPC Flow Logs for exfiltration monitoring
Create a Cloud KMS key ring and symmetric key in europe-west3; grant the CryptoKey Encrypter/Decrypter role to the Compute Engine, Cloud Storage, and Dataproc service agents; create an europe-west3 CMEK-encrypted staging bucket; create the Dataproc cluster in europe-west3 specifying the --kms-key and --bucket flags; and secure the projects within a VPC Service Controls perimeter enclosing Cloud KMS, Dataproc, Compute Engine, and Cloud Storage
This architecture establishes an end-to-end regional data processing boundary by combining localized Cloud Key Management Service (Cloud KMS) Customer-Managed Encryption Keys (CMEK), regional Dataproc compute resources, and a VPC Service Controls service perimeter.
StudyCerts
StudyCertseurope-west3 region guarantees that the cryptographic key material is created, stored, and processed solely within that specific geographic location, meeting sovereign data residency mandates.roles/cloudkms.cryptoKeyEncrypterDecrypter role to the Compute Engine, Cloud Storage, and Dataproc service agents enables full cryptographic access across all stages of processing. Using --kms-key on the Dataproc cluster encrypts the persistent disks and submitted job arguments, while the --bucket flag specifies a dedicated Cloud Storage staging bucket encrypted with the regional CMEK.europe-west3).Google Cloud requires CMEK keys to reside in the exact same region as the underlying resources they protect. Provisioning single-region keys in europe-west3 alongside matching regional Dataproc clusters and staging buckets ensures complete functional compatibility and strict compliance with territorial data residency laws.
Create a dual-region Cloud KMS key ring in the europe-west4 and europe-west1 locations; assign the CryptoKey Admin role to the Dataproc VM default service account; deploy the Dataproc cluster using default staging buckets; and rely on standard Cloud IAM policies for egress control