Security Architecture →hardMultiple Select

CAS-004 Security Architecture Practice Question

A global company must comply with data residency regulations that require customer data to stay within specific geographic boundaries. The company uses a multi-cloud architecture. Which THREE strategies should the architect implement to ensure compliance?

⚠ Common exam trap

CAS-005 often tests the confusion between data security controls (encryption, IAM) and data residency controls, so candidates must focus on geographic restrictions rather than general security measures.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Using cloud provider's region-specific services and data centers

Option A is correct because using region-specific services and data centers ensures that data is physically stored and processed within the required geographic boundaries, directly satisfying data residency mandates. Option D is correct because data classification tags identify which data is subject to residency regulations, enabling architects to apply location-based controls and policies only to regulated data. Option E is correct because DLP policies can detect and block cross-border transfers of regulated data, preventing accidental or unauthorized movement outside approved regions. Option B is not correct because encryption at rest and in transit protects confidentiality but does not restrict where data is stored or transferred, so it does not ensure residency. Option C is not correct because IAM policies control who can access data, not where data resides or whether it crosses borders.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Using cloud provider's region-specific services and data centers
Why this is correct
Selecting region-specific services and data centres keeps storage and processing physically inside the mandated geography, satisfying the residency boundary directly. In a multi-cloud estate, each provider's regional endpoints must be chosen so customer data never replicates outside the permitted jurisdiction.
✗
Encrypting all data at rest and in transit
Why it's wrong here
Encryption protects confidentiality but does not constrain where data is stored or processed, so it cannot satisfy geographic residency boundaries. It is tempting because encryption is a core data-protection control, and it would be the right answer for a question about safeguarding data confidentiality rather than controlling its location.
✗
Implementing strict identity and access management (IAM) policies
Why it's wrong here
IAM policies govern who may access resources, not where those resources or their data physically reside, so they cannot enforce geographic boundaries. They are tempting because identity controls underpin most cloud security postures, and would be correct for a question about restricting access to sensitive data.
✓
Configuring data classification tags to identify regulated data
Why this is correct
Classification tags label data according to its regulatory category, giving policy engines the metadata needed to route, store and restrict regulated records by geography. Without accurate tagging, residency controls cannot distinguish customer data requiring in-region handling from unrestricted content.
✓
Deploying data loss prevention (DLP) policies to block cross-border data transfers
Why this is correct
DLP policies inspect data flows and block transfers that would move regulated records across borders, providing an enforcement control at egress points. This directly prevents the cross-border movement that residency regulations prohibit, complementing regional storage choices.

Go deeper

CAS-004 Security Architecture Practice Question

Why each option matters

Option-by-option breakdown

Related to this question