Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Cloud Audit Logs to detect and alert on cross-region data storage

  Why it's wrong here

  Cloud Audit Logs records data access and administrative actions, including where a BigQuery job ran, but it is a detective control. It can only alert you after a dataset has already been created in an unauthorized region, not prevent the creation in the first place. Data residency requires a hard enforcement mechanism, like an Organization Policy constraint that rejects non-compliant resource creation at the API layer.

• ✗

  Use Cloud Data Loss Prevention to redact cross-region data

  Why it's wrong here

  Cloud Data Loss Prevention (DLP) inspects content for sensitive data such as PII or credit card numbers and can redact or mask that content. It operates purely on the data's content and has no awareness of a dataset's regional location, nor any ability to change where the dataset is stored. Using DLP to 'redact cross-region data' conflates content inspection with infrastructure geography; location compliance is a resource-level property controlled by policies, not by content transformation.

• ✗

  Use VPC Service Controls to block access to BigQuery APIs from other regions

  Why it's wrong here

  VPC Service Controls builds security perimeters that block API calls from unauthorized networks or identities, but it does not influence the physical location where BigQuery stores data. A dataset created in a disallowed region remains in that region regardless of VPC SC rules because the location is fixed at dataset creation time. For data residency, you need to restrict the location parameter itself, not the network path used to access the API.

• ✓

  Use BigQuery’s location parameter to set dataset location and enforce via Organization Policy

  Why this is correct

  In BigQuery, every dataset is created with a `location` parameter (e.g., `US`, `EU`, or a specific region like `asia-south1`) that determines where all tables and temporary storage are physically held. The Organization Policy constraint `gcp.resourceLocations` can be applied at the organization, folder, or project level to define an allowlist of regions; any attempt to create a dataset outside that allowlist is immediately denied. This dual approach gives you both the granularity to assign a dataset to a compliant region and a preventive policy guardrail that enforces residency across all projects.

Go deeper

Related to this question