A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment: Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources. Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project. Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities. Which combination of controls and Organization Policies should the enterprise implement?

Apply the `constraints/gcp.restrictNonCmekServices` and `constraints/gcp.restrictCmekCryptoKeyProjects` organization policies, create regional symmetric Cloud KMS keys in the dedicated project, and grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the respective service agents on the specific keys.: What the CMEK Governance and IAM Solution Is This architecture combines native Google Cloud Organization Policy constraints with granular Identity and Access Management (IAM) permissions on regional Cloud KMS CryptoKeys to establish strict cryptographic boundary isolation, automated compliance enforcement, and least privilege access governance. How It Meets Regulatory Requirements Mandatory CMEK enforcement: Applying the constraints/gcp.restrictNonCmekServices organization policy constraint blocks the creation of resources using Google default encryption across specified supported services, ensuring that data is encrypted using customer-managed keys. Cryptographic key isolation and residency: The constraints/gcp.restrictCmekCryptoKeyProjects constraint restricts the resource hierarchy locations from which CMEK keys can be selected, ensuring keys only come from the approved, dedicated Cloud KMS project and valid regional locations. Least privilege access governance: Granting the roles/cloudkms.cryptoKeyEncrypterDecrypter role directly on individual crypto keys to the specific Google-managed service agents (such as service-PROJECT_NUMBER@gcp-sa-...iam.gserviceaccount.com) ensures that only authorized workload identities can perform cryptographic operations without over-granting key administrative permissions. Key Advantages and Capabilities Preventative Guardrails: Prevents accidental provisioning of non-compliant resources before deployment completes. Centralized Key Management: Allows separation of duties between Cloud KMS key administrators in the security host project and workload administrators in application projects. Regional Data Residency: Guarantees that the key rings and the protected data services remain co-located in the designated compliance region. Granular IAM Scoping: Binds cryptographic permissions to specific key resources rather than granting broad project-level permissions. Why This Is Optimal This solution uses native organization policies to automatically enforce compliance guardrails without requiring custom post-deployment remediation scripts. It perfectly balances preventative security controls with least-privilege identity access management.

Enforce Cmek Org Policies Least Privilege | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A financial services organization hosted on Google Cloud must comply with strict regulatory auditability and threat monitoring requirements across all existing and future projects in its resource hierarchy. The compliance and security teams mandate the following requirements: Capture all Admin Activity and full Data Access audit logs (DATA_READ, DATA_WRITE, and ADMIN_READ) across all services. Centrally aggregate all audit log entries across the entire resource hierarchy without missing newly created projects. Store audit logs in an immutable archive for seven years that prevents modification or premature deletion by any identity, including administrators. Detect threat behaviors in near real-time, such as anomalous IAM role grants and privilege escalation attempts. Which architecture should the security engineer implement to satisfy these compliance and monitoring requirements?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a Cardholder Data Environment (CDE) on Google Cloud to meet stringent PCI-DSS and FedRAMP network segmentation and perimeter defense mandates. The architecture deploys a Shared VPC host project for centralized network management alongside multiple service projects hosting compute workloads, Cloud Build private pools, and Cloud Storage buckets containing sensitive cardholder data. Which architectural requirement must be implemented to enforce the VPC Service Controls boundary across this infrastructure without breaking communication?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise is establishing a data governance and encryption framework on Google Cloud to comply with strict regional data sovereignty and regulatory standards. The compliance baseline dictates the following technical requirements: All regional service data must be encrypted using Customer-Managed Encryption Keys (CMEK) protected by hardware security modules (Cloud HSM). Key management must enforce strict separation of duties between key custodians and application resource administrators. Key rotation must occur periodically such that newly written data uses the latest cryptographic key version while existing historical data remains continuously decryptable without data loss. Which Cloud KMS configuration and lifecycle management strategy should the security architect specify?

Determining technical needs relative to compute, data, network, and storage.

AdvancedProfessional Cloud Security Engineer

An enterprise is migrating general application workloads, secrets, and log data to Google Cloud services such as Cloud Storage and Secret Manager. The enterprise's security policy mandates that all data at rest must satisfy NIST-approved baseline encryption standards, while the operations team wants to avoid the administrative burden of provisioning and managing custom key infrastructure. Which statement accurately evaluates the underlying architecture, baseline security capabilities, and operational limitations of Google default encryption (Google-managed encryption keys)?

Identifying use cases for Google default encryption, customer-managed encryption keys (CMEK), and Cloud External Key Manager (EKM).

AdvancedProfessional Cloud Security Engineer

An enterprise is refactoring its security architecture on Google Cloud to adhere to the principle of least privilege and strict separation of duties. Currently, developers run automated deployment pipelines and scheduled tasks using their personal corporate user accounts, which requires assigning them broad, standing permissions. Furthermore, developers have generated and downloaded service account JSON keys to authenticate external CI/CD runners, and they occasionally impersonate service accounts directly in production to resolve urgent incidents. The security engineering team has established the following mandatory requirements: Decouple application execution and automated workflows from human identities. Eliminate the risks associated with static, long-lived service account key files. Prevent human identities from undermining context-aware access controls through service account impersonation. Provide human operators with just-in-time (JIT), time-bound privilege elevation for emergency tasks without granting standing administrative access. Which strategy should the security engineer implement to satisfy these requirements?

Identifying scenarios requiring service accounts.

IntermediateProfessional Cloud Architect

Dataproc Metastore

Evolution of business needs

Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

Related questions

Dataproc Metastore

Professional Cloud Security Engineer

Enforce Cmek Org Policies Least Privilege

What the CMEK Governance and IAM Solution Is

How It Meets Regulatory Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Dataproc Metastore

What the CMEK Governance and IAM Solution Is

How It Meets Regulatory Requirements

Key Advantages and Capabilities

Why This Is Optimal