A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment: Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources. Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project. Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities. Which combination of controls and Organization Policies should the enterprise implement?

Apply the `constraints/gcp.restrictNonCmekServices` and `constraints/gcp.restrictCmekCryptoKeyProjects` organization policies, create regional symmetric Cloud KMS keys in the dedicated project, and grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the respective service agents on the specific keys.: What the CMEK Governance and IAM Solution Is This architecture combines native Google Cloud Organization Policy constraints with granular Identity and Access Management (IAM) permissions on regional Cloud KMS CryptoKeys to establish strict cryptographic boundary isolation, automated compliance enforcement, and least privilege access governance. How It Meets Regulatory Requirements Mandatory CMEK enforcement: Applying the constraints/gcp.restrictNonCmekServices organization policy constraint blocks the creation of resources using Google default encryption across specified supported services, ensuring that data is encrypted using customer-managed keys. Cryptographic key isolation and residency: The constraints/gcp.restrictCmekCryptoKeyProjects constraint restricts the resource hierarchy locations from which CMEK keys can be selected, ensuring keys only come from the approved, dedicated Cloud KMS project and valid regional locations. Least privilege access governance: Granting the roles/cloudkms.cryptoKeyEncrypterDecrypter role directly on individual crypto keys to the specific Google-managed service agents (such as service-PROJECT_NUMBER@gcp-sa-...iam.gserviceaccount.com) ensures that only authorized workload identities can perform cryptographic operations without over-granting key administrative permissions. Key Advantages and Capabilities Preventative Guardrails: Prevents accidental provisioning of non-compliant resources before deployment completes. Centralized Key Management: Allows separation of duties between Cloud KMS key administrators in the security host project and workload administrators in application projects. Regional Data Residency: Guarantees that the key rings and the protected data services remain co-located in the designated compliance region. Granular IAM Scoping: Binds cryptographic permissions to specific key resources rather than granting broad project-level permissions. Why This Is Optimal This solution uses native organization policies to automatically enforce compliance guardrails without requiring custom post-deployment remediation scripts. It perfectly balances preventative security controls with least-privilege identity access management.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enforce Cmek Org Policies Least Privilege

Section: Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment:

Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources.
Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project.
Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities.

Which combination of controls and Organization Policies should the enterprise implement?

Enable Data Access audit logs with DATA_READ for all services, disable default service account creation, and assign roles/cloudkms.cryptoKeyViewer to all workload identities on the KMS key ring.

Deploy VPC Service Controls around all service projects, configure Cloud KMS Autokey at the folder level, and grant roles/owner to the workload service accounts on the host project.

Apply the constraints/gcp.restrictNonCmekServices and constraints/gcp.restrictCmekCryptoKeyProjects organization policies, create regional symmetric Cloud KMS keys in the dedicated project, and grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the respective service agents on the specific keys.

Apply the constraints/gcp.resourceLocations organization policy constraint, configure Cloud KMS with asymmetrical signing keys in a multi-region location, and grant roles/cloudkms.admin to the default Compute Engine service account.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enforce Cmek Org Policies Least Privilege

Section: Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources.
Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project.
Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities.

Which combination of controls and Organization Policies should the enterprise implement?

Enable Data Access audit logs with DATA_READ for all services, disable default service account creation, and assign roles/cloudkms.cryptoKeyViewer to all workload identities on the KMS key ring.

Deploy VPC Service Controls around all service projects, configure Cloud KMS Autokey at the folder level, and grant roles/owner to the workload service accounts on the host project.

Explanations

What the CMEK Governance and IAM Solution Is

This architecture combines native Google Cloud Organization Policy constraints with granular Identity and Access Management (IAM) permissions on regional Cloud KMS CryptoKeys to establish strict cryptographic boundary isolation, automated compliance enforcement, and least privilege access governance.

How It Meets Regulatory Requirements

Mandatory CMEK enforcement: Applying the constraints/gcp.restrictNonCmekServices organization policy constraint blocks the creation of resources using Google default encryption across specified supported services, ensuring that data is encrypted using customer-managed keys.
Cryptographic key isolation and residency: The constraints/gcp.restrictCmekCryptoKeyProjects constraint restricts the resource hierarchy locations from which CMEK keys can be selected, ensuring keys only come from the approved, dedicated Cloud KMS project and valid regional locations.
Least privilege access governance: Granting the roles/cloudkms.cryptoKeyEncrypterDecrypter role directly on individual crypto keys to the specific Google-managed service agents (such as service-PROJECT_NUMBER@gcp-sa-...iam.gserviceaccount.com) ensures that only authorized workload identities can perform cryptographic operations without over-granting key administrative permissions.

Key Advantages and Capabilities

Preventative Guardrails: Prevents accidental provisioning of non-compliant resources before deployment completes.
Centralized Key Management: Allows separation of duties between Cloud KMS key administrators in the security host project and workload administrators in application projects.
Regional Data Residency: Guarantees that the key rings and the protected data services remain co-located in the designated compliance region.
Granular IAM Scoping: Binds cryptographic permissions to specific key resources rather than granting broad project-level permissions.

Why This Is Optimal

This solution uses native organization policies to automatically enforce compliance guardrails without requiring custom post-deployment remediation scripts. It perfectly balances preventative security controls with least-privilege identity access management.

View source documentation

Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

What the CMEK Governance and IAM Solution Is

How It Meets Regulatory Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions