An enterprise is deploying an AI agent solution built on the Gemini platform on Google Cloud. The architecture processes real-time user prompts, retrieves context from backend storage, and persists conversation history and model outputs. The security team mandates the following compliance and data governance requirements: Data Residency and Sovereignty: All prompt inputs, model outputs, and training datasets (at rest, in use, and in transit) must strictly remain within the europe-west1 region and be prevented from crossing virtual network boundaries. In-flight Data Governance: Sensitive data within user prompts and agent responses must be classified and de-identified synchronously in real time before persistence. Cryptographic Control: All stored data must be encrypted with Customer-Managed Encryption Keys (CMEK) rooted in the same geographic region. Which combination of security controls should the security engineer implement?

Configure real-time prompt and output sanitization using the Cloud DLP synchronous `content.deidentify` method targeting the `dlp.europe-west1.rep.googleapis.com` regional endpoint; enforce the `constraints/gcp.restrictEndpointUsage` and `constraints/gcp.resourceLocations` organization policies; enclose services within a VPC Service Controls perimeter; and configure CMEK using Cloud KMS keys created in `europe-west1`.: What the solution is This architecture combines Sensitive Data Protection (Cloud DLP) regional endpoints, VPC Service Controls, Cloud KMS, and Organization Policy Service constraints to establish end-to-end data governance, strict data residency, and encryption for AI workloads. How it meets all requirements In-flight Data Governance: The synchronous content.deidentify API method of Cloud DLP inspects and de-identifies prompt strings and model responses in real time before data reaches persistent backend storage. Data Residency and In-Transit Sovereignty: Calling the regional endpoint dlp.europe-west1.rep.googleapis.com ensures that TLS sessions terminate inside europe-west1, guaranteeing that data at rest, in use, and in transit never leaves the specified region. Enforcing constraints/gcp.restrictEndpointUsage prevents client calls from accidentally routing to global endpoints. Resource Location Enforcement: Enforcing constraints/gcp.resourceLocations limits resource provisioning strictly to europe-west1 across all projects. Perimeter Isolation: VPC Service Controls defines a security perimeter around storage, AI APIs, and database services, preventing unauthorized exfiltration and ingress across project boundaries. Cryptographic Control: CMEK keys provisioned via Cloud KMS in europe-west1 wrap local data encryption keys (DEKs) ensuring full customer control over encryption at rest. Key advantages and capabilities Zero Regional Spillover: Regional API endpoints prevent traffic from terminating at Google's global points of presence outside the sovereign boundary. Synchronous Protection: Inline masking with content methods sanitizes generative AI inputs and outputs before storage. Defense-in-Depth: Combines network perimeters (VPC-SC), resource placement constraints, cryptographic controls (CMEK), and payload inspection.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Gemini Ai Governance Residency Protection

Section: Implementing security controls for Gemini Enterprise Agent Platform.

An enterprise is deploying an AI agent solution built on the Gemini platform on Google Cloud. The architecture processes real-time user prompts, retrieves context from backend storage, and persists conversation history and model outputs.

The security team mandates the following compliance and data governance requirements:

Data Residency and Sovereignty: All prompt inputs, model outputs, and training datasets (at rest, in use, and in transit) must strictly remain within the europe-west1 region and be prevented from crossing virtual network boundaries.
In-flight Data Governance: Sensitive data within user prompts and agent responses must be classified and de-identified synchronously in real time before persistence.
Cryptographic Control: All stored data must be encrypted with Customer-Managed Encryption Keys (CMEK) rooted in the same geographic region.

Which combination of security controls should the security engineer implement?

Configure real-time prompt and output sanitization using the Cloud DLP synchronous content.deidentify method targeting the dlp.europe-west1.rep.googleapis.com regional endpoint; enforce the constraints/gcp.restrictEndpointUsage and constraints/gcp.resourceLocations organization policies; enclose services within a VPC Service Controls perimeter; and configure CMEK using Cloud KMS keys created in europe-west1.

Implement Private Services Access with VPC Network Peering to access AI APIs; apply Cloud Storage Bucket Lock policies to prevent modification; and generate asymmetric signing keys in Cloud KMS to de-identify prompt payloads.

Call the global Cloud DLP endpoint with the location parameter set to locations/europe-west1/content:deidentify; apply the constraints/gcp.resourceLocations organization policy; configure default Google-managed encryption keys; and rely on Cloud Armor WAF rules to restrict API egress across regions.

Configure asynchronous Cloud DLP scheduled inspection job triggers on backend Cloud Storage buckets; enable Cloud KMS Autokey in multi-region europe; and use Serverless VPC Access connectors without VPC Service Controls perimeters.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Gemini Ai Governance Residency Protection

Section: Implementing security controls for Gemini Enterprise Agent Platform.

The security team mandates the following compliance and data governance requirements:

Data Residency and Sovereignty: All prompt inputs, model outputs, and training datasets (at rest, in use, and in transit) must strictly remain within the europe-west1 region and be prevented from crossing virtual network boundaries.
In-flight Data Governance: Sensitive data within user prompts and agent responses must be classified and de-identified synchronously in real time before persistence.
Cryptographic Control: All stored data must be encrypted with Customer-Managed Encryption Keys (CMEK) rooted in the same geographic region.

Which combination of security controls should the security engineer implement?

Explanations

What the solution is

This architecture combines Sensitive Data Protection (Cloud DLP) regional endpoints, VPC Service Controls, Cloud KMS, and Organization Policy Service constraints to establish end-to-end data governance, strict data residency, and encryption for AI workloads.

How it meets all requirements

In-flight Data Governance: The synchronous content.deidentify API method of Cloud DLP inspects and de-identifies prompt strings and model responses in real time before data reaches persistent backend storage.
Data Residency and In-Transit Sovereignty: Calling the regional endpoint dlp.europe-west1.rep.googleapis.com ensures that TLS sessions terminate inside europe-west1, guaranteeing that data at rest, in use, and in transit never leaves the specified region. Enforcing constraints/gcp.restrictEndpointUsage prevents client calls from accidentally routing to global endpoints.
Resource Location Enforcement: Enforcing constraints/gcp.resourceLocations limits resource provisioning strictly to europe-west1 across all projects.
Perimeter Isolation: VPC Service Controls defines a security perimeter around storage, AI APIs, and database services, preventing unauthorized exfiltration and ingress across project boundaries.
Cryptographic Control: CMEK keys provisioned via Cloud KMS in europe-west1 wrap local data encryption keys (DEKs) ensuring full customer control over encryption at rest.

Key advantages and capabilities

Zero Regional Spillover: Regional API endpoints prevent traffic from terminating at Google's global points of presence outside the sovereign boundary.
Synchronous Protection: Inline masking with content methods sanitizes generative AI inputs and outputs before storage.
Defense-in-Depth: Combines network perimeters (VPC-SC), resource placement constraints, cryptographic controls (CMEK), and payload inspection.

View source documentation

Professional Cloud Security Engineer

Gemini Ai Governance Residency Protection

Professional Cloud Security Engineer

Gemini Ai Governance Residency Protection

What the solution is

How it meets all requirements

Key advantages and capabilities

Related questions