Google Cloud Digital Leader (GCDL) — Questions 226–300

Labels are key-value metadata attached to GCP resources, such as 'team' or 'environment', and they are the primary mechanism for sorting and grouping costs within an exported billing dataset. When combined with BigQuery billing export, labels let you slice costs by project, service, team, or any custom dimension, enabling exact repartition of spend. They are the correct tool because they make cost data attributable and queryable.

Pub/Sub is purpose-built for this pattern. IoT devices publish messages to a Pub/Sub topic; backend systems subscribe and process at their own rate. Pub/Sub buffers messages during spikes, guarantees at-least-once delivery, and scales to millions of messages per second without configuration changes.

Cloud Run is a fully managed serverless container platform that executes your container only when a request arrives. It automatically scales down to zero instances during idle periods, meaning you pay nothing when there is no traffic, and it scales up instantly to handle incoming requests. Because it directly supports container images and abstracts all infrastructure, it is the simplest and most cost-efficient choice for deploying a containerized web application.

Gemini for Workspace, formerly Duet AI, is the generative AI assistant natively integrated into Google Workspace applications such as Gmail, Docs, Sheets, and Meet. It leverages the Gemini model family and is grounded in the user's Workspace content to summarize threads, draft documents, and automate tasks, while inheriting Workspace's enterprise-grade security and data governance. It is designed specifically as the AI companion for Workspace users, requiring no custom ML development.

This is correct. Strong consistency guarantees that after a write (player moves), all subsequent reads from any client see that write. This ensures all players operate on the same view of game state. Cloud Spanner's external consistency or Firestore's strongly consistent reads serve this requirement.

Cloud Asset Inventory provides a single, org-wide searchable view of all compute.googleapis.com/Instance assets via the Cloud Asset API or Console asset search. It returns complete VM metadata—zone/region, machine type, network interfaces, external IP, labels, and status—without per-project login, and can be exported or queried programmatically, making it the only option that directly and comprehensively answers the request.

Cloud CDN serves as a caching layer that shields backend origins by absorbing requests and can deliver cached content globally with low latency. When integrated with Cloud Armor, CDN policies evaluate incoming requests against WAF rules before they reach the origin, making it a valid component in a protection strategy; however, the WAF itself is Cloud Armor, not CDN.

The organization node is the root of the Google Cloud resource hierarchy and is automatically provisioned when you set up Google Workspace or Cloud Identity — it is never created manually. Simply having the Workspace/Identity tenant is not enough; you must explicitly link it to the organization node in the Google Cloud console. This action establishes the trust relationship that enables organization-level IAM policies, resource constraints, and audit logging across all current and future projects. Until this link is made, you do not have an operational root node to attach folders or projects to, so this is the correct first step.

Committed Use Discounts (CUDs) allow you to commit to a specific amount of vCPUs, memory, or spend for a 1- or 3-year term, in exchange for a substantially reduced price. By purchasing a commitment, you reserve capacity and pay a predictable lower rate for the entire term, making it the appropriate mechanism to reserve Compute Engine resources for a 3-year period.

This is the correct Zero Trust-aligned approach. A service account is attached to the VM or GKE pod. The workload calls the metadata server (169.254.169.254) to get a short-lived (1-hour) access token automatically. No key file is created, stored, or managed — eliminating the key compromise risk entirely. Workload Identity in GKE extends this to Kubernetes service accounts.

Dialogflow CX is Google Cloud's advanced conversational AI platform for building virtual agents and chatbots. It uses natural language understanding (NLU) to detect user intent, extract entities, and manage multi-turn conversation flows with explicit state machines. It also offers integrations across channels like Google Assistant, web, and telephony, and is the core technology behind Vertex AI Conversation for enterprise-scale conversational apps.

This captures both sides accurately. Private cloud satisfies regulatory requirements for data control and residency. But the organization must fund all infrastructure, skilled operations staff, and hardware refresh — at costs that rarely match public cloud's shared-scale economics. Elasticity is limited to what the organization has built, not global resource pools.

Secret Manager is the correct choice because it is a dedicated, purpose-built service for storing and managing sensitive data such as API keys, passwords, and certificates as immutable secret versions. It provides fine-grained IAM roles, automatic log-based auditing, built-in rotation with etag validation, and integration with App Engine, Cloud Functions, and Kubernetes workloads. You can upload certificate data directly as a secret payload and access it securely via the Secret Manager API or client libraries, giving the developer exactly the managed workflow they need.

Running the application in multiple GCP regions, such as europe-west1 and europe-west4, places compute capacity near EU users, cutting round-trip time. It also enables active-active or active-passive failover, so if one region fails traffic can be served from another, improving availability.

Dataproc is the correct choice for managed Apache Spark. The ephemeral cluster pattern (create cluster → run Spark job → delete cluster) is the recommended cost-optimization approach for batch jobs. The cluster exists only while needed, minimizing cost.

Cloud Armor is Google Cloud's DDoS mitigation and WAF service. It integrates with Google's global load balancers to absorb volumetric attacks at the edge before they reach backend servers. Its Adaptive Protection feature automatically detects and responds to DDoS patterns in real time.

The Principle of Least Privilege is the core concept here. Owner role is far broader than necessary. By granting a specific role matching actual requirements, the security team limits the blast radius if the developer's account is compromised and reduces the risk of accidental destructive actions.

BigQuery is a fully managed, serverless data warehouse that separates storage from compute, enabling interactive SQL queries over petabytes of data via a high-speed columnar execution engine. Its architecture, using the Dremel query engine, distributes queries across thousands of nodes, delivering sub-second to seconds response times on massive datasets without requiring infrastructure provisioning. This makes it the ideal choice for running ad-hoc, interactive analytics on petabyte-scale data.

Cloud Run runs stateless containers on a fully managed serverless platform, automatically scaling from zero based on incoming requests and charging only for CPU and memory used during request processing. Since you simply provide a container image that implements an HTTP server, a containerized web app can be deployed with zero infrastructure provisioning, making it the lowest-friction, pay-per-use option for a startup.

Document AI is the correct choice because it provides purpose-built pre-trained processors such as the Invoice Parser, which are specifically designed to extract structured fields like vendor name, invoice number, due date, and line items from scanned or digital documents. These processors combine OCR with a domain-aware NLP model, so they understand document layouts and key-value pair conventions unique to invoices without any custom training.

Cloud Armor is a Google Cloud managed security service that provides DDoS protection and a web application firewall (WAF). By enabling preconfigured WAF rules and attaching Cloud Armor policies to the external load balancer, the service inspects incoming HTTP(S) traffic at the edge, blocking common application-layer attacks such as SQL injection and cross-site scripting (XSS) before they reach backend instances. This is exactly what the e-commerce site needs for L7 protection and volumetric attack mitigation.

Speed and agility are direct results of cloud's on-demand self-service model: compute, storage, and networking resources are provisioned through APIs and templates in minutes, versus six to eight weeks for ordering, shipping, racking, and configuring physical hardware. This capability collapses the startup's lead time, moving it from idea to globally deployed application in days. It also enables iterative DevOps workflows, because resources can be created, scaled, and destroyed on the fly to match changing demand.

A managed instance group with autoscaling based on CPU utilization automatically adjusts the number of VM instances to match current demand. The autoscaler adds instances when average CPU utilization exceeds a target threshold, and removes instances when utilization drops, providing elastic horizontal scaling. This yields both high availability under spikes and cost efficiency during low usage, all without manual intervention.

Google Cloud automatically encrypts all data at rest using AES-256, and this is enabled by default for every service, including Cloud Storage. No configuration, bucket settings, or key provision steps are needed to activate encryption. If a customer wants more control, they can optionally use Cloud KMS with CMEK or CSEK, but that enhances key management rather than providing encryption, which already exists.

Cloud providers aggregate demand from many customers to purchase and operate hardware at a massive scale, driving down unit costs that are passed on as lower pay-as-you-go prices. This converts capital expenditure into operating expense and minimizes idle capacity, directly improving operational efficiency through resource sharing.

Sustainability (renewable energy match) is correct because Google Cloud commits to matching 100% of its global electricity consumption with renewable energy purchases, using power purchase agreements (PPAs) and carbon-free energy contracts. This means every kilowatt-hour used by Google Cloud services is offset by wind or solar generation, directly reducing the carbon footprint of workloads. Additionally, Google is progressing toward 24/7 carbon-free energy on all grids by 2030, which further strengthens the environmental case for choosing Google Cloud.

9 minutes (540 seconds) is the correct maximum timeout for 1st gen Cloud Functions. This is a platform-enforced hard limit; you can configure the timeout field to any value between 1 and 540 seconds, but values above that are not accepted.

A managed instance group with an autoscaling policy automatically adjusts the number of VM instances based on load signals such as CPU utilization, requests per second, or Cloud Monitoring custom metrics. The autoscaling controller provisions additional instances when a spike begins and removes them when demand drops, all without human intervention. Using an instance template and health checks, the MIG also replaces unhealthy VMs, ensuring that the load balancer only routes traffic to ready instances, which makes it ideal for handling sudden traffic spikes.

Firestore is a mobile-first document database with built-in offline persistence: data is stored locally on the device, enabling reads and writes without connectivity. When the device reconnects, Firestore automatically synchronizes local changes to the server and resolves conflicts using deterministic rules (e.g., last-write-wins by server timestamp). Its SDK offers real-time listeners that push updates to clients, making it ideal for chat, collaboration, and other interactive mobile features. Firestore's security rules and transaction support further streamline mobile backend development.

loadbalancing/https/request_count is a native proxy-layer metric emitted by the HTTPS load balancer that increments for every client request matched to a particular backend service and region. Filtering by backend service and region lets you directly compare request volumes across global backends and quickly spot imbalances, regional affinity misconfigurations, or unhealthy pools that are not receiving traffic. It is the correct metric for verifying global load balancing behavior and for building request-rate-based alerts, though note that it counts all requests, including 4xx/5xx responses, at the load balancer itself.

IAM conditions can deny the compute.instances.create permission unless the request includes an 'environment' label, effectively forcing callers to specify the label via conditional access. This works for individual principals or groups, but it becomes hard to maintain as you must attach conditions to every relevant role binding and it does not cover other API pathways or built-in roles.

A Cloud Logging sink (also called a log router) is the correct and only managed mechanism for exporting log entries to a destination such as a Cloud Storage bucket. You can define an inclusion filter (e.g., specific resource types or severities) and choose Cloud Storage as the destination, and the Log Router will continuously deliver new log entries into the bucket. To meet a 7-year archival requirement, you must also configure a bucket retention policy or lifecycle rule so that objects are retained for the mandatory period and not deleted by default lifecycle actions. This approach is automated, auditable, and requires no custom code or manual downloads.

Google Cloud maintains data centers in dozens of regions worldwide, so the startup can provision infrastructure in a new market within hours via the console, CLI, or APIs. Because workloads are packaged as code (Terraform, Deployment Manager, etc.), the exact same IaC templates can be applied to a new region with minimal changes (e.g., region variable and maybe quota adjustments). This eliminates the years-long physical data-center build cycle and makes global expansion fast, repeatable, and consistent.

AutoML Natural Language is the intended Google Cloud service for training a custom text classification or entity-extraction model through a graphical, low-code workflow. It accepts labeled customer comments and builds a model using transfer learning, allowing the organization to incorporate domain-specific vocabulary and idiomatic expressions without writing code. This directly addresses the need to analyze customer text with a tailored model, making it the correct choice.

Looker is Google Cloud's enterprise BI platform, purpose-built for interactive dashboards and governed reporting directly on BigQuery. It uses LookML, a semantic modeling language that defines business logic and metrics in a central repository, ensuring consistent, version-controlled definitions across all dashboard consumers. With embedded analytics, scheduled reports, and row-level security, Looker is the correct fit for this analyst's requirements.

Lowering `max_connections` caps the number of concurrent client sessions, and each session reserves per-thread memory for sort buffers, join buffers, and temporary tables. Reducing this flag therefore directly bounds the aggregate connection-level memory consumption on the instance, preventing memory exhaustion and out-of-memory restarts. It is the correct remediation because the symptom is memory pressure, not disk capacity or query routing.

Cloud Run is a serverless compute platform that executes stateless HTTP-driven containers on demand. When no requests are in flight, the service scales down to zero instances, so you are not billed for idle resources. It automatically provisions and scales instances up to handle spikes, supports any language and arbitrary Docker images, and only charges for the exact number of requests processed, making it a natural fit for a containerized microservice with intermittent traffic.

Google Cloud mandates TLS (HTTPS) for every external call to its public API endpoints, covering services like BigQuery and Cloud Storage. This requirement is enforced at the infrastructure level, so clients must use TLS to communicate, regardless of the client library or SDK. As a result, data confidentiality and integrity are protected from the client to Google's edge, and users do not need to configure certificates themselves.

Security Command Center is the central security and risk management platform for Google Cloud, aggregating findings from built-in and third-party services, including Security Health Analytics, Event Threat Detection, Cloud Asset Inventory, and Cloud Armor. It gives security teams a single pane of glass to view vulnerabilities, misconfigurations, and active threats across all projects. This service includes preset compliance metrics, malware discovery, and integration with Google Cloud's Web Security Scanner and partner solutions. Its role as the unified findings hub is exactly why it is the recommended solution for threat detection and response at cloud scale.

This scenario directly describes a smart city architecture: IoT sensors feed real-time data into a cloud platform, where AI analytics identify operational inefficiencies and trigger automated responses—such as adjusting traffic signal timing, rerouting waste collection, or balancing energy loads. The result is continuous optimization of city resources and services, which is the defining goal of a smart city rather than a single technology or isolated service.

Cloud Armor is Google Cloud's Web Application Firewall (WAF) service that provides edge-based protection against application-layer attacks such as SQL injection and cross-site scripting (XSS). It uses pre-configured rules, including the OWASP Top 10 rule set, as well as custom rules in Common Expression Language (CEL) to filter malicious traffic before it reaches backend instances. Cloud Armor integrates with Cloud Load Balancing and can also provide DDoS protection with adaptive protection and rate limiting. This makes it the correct choice for blocking common web attacks.

This option correctly identifies the hierarchy among the three concepts. An SLI is the actual measured metric that quantifies service performance, such as 'the proportion of requests completed successfully' or 'latency at the 95th percentile.' An SLO is an internal target value for that SLI, e.g., 'maintain 99.9% availability over a 30-day window,' which guides engineering priorities. An SLA is a contractual commitment to a customer that often sets a stricter threshold and defines compensations, such as 'if availability falls below 99.5%, issue a service credit—the SLA is a business agreement, not just an engineering metric.'

The Custom Metrics Stackdriver Adapter is the correct component because it implements the Kubernetes custom metrics API and exposes Stackdriver (now Cloud Monitoring) metrics to the Horizontal Pod Autoscaler. Without this adapter, HPA can only see built-in CPU and memory metrics, not application-specific metrics like orders per second or checkout latency. Installing and configuring this adapter allows HPA to query custom metrics and scale pod replicas accordingly, making it essential for autoscaling on arbitrary business metrics.

Managed instance groups with autoscaling directly address sudden spikes by continuously evaluating metrics such as CPU utilization, requests per second, or custom Cloud Monitoring signals and adjusting the number of VM instances within configured minimum and maximum boundaries. When a spike is detected, the autoscaler provisions additional VMs and then scales down after demand subsides, while health checks and instance templates ensure each new VM is immediately ready to serve traffic. This is the standard Google Cloud solution for elastic compute capacity behind a load balancer.

Google's contractual data processing commitments, including the Cloud Data Processing Addendum, state that Google will not access or use customer data without authorization, and will only do so for the purposes of providing the services. Access Transparency provides customers with near-real-time logs of all system access by Google Cloud personnel, including the reason for access. Combined with Access Approval, which lets customers approve or deny select access requests, these tools ensure data is accessed only as permitted. This makes the statement accurate and correct.

Cloud Firestore and Firebase Realtime Database are purpose-built for real-time client synchronization. Firestore uses real-time listeners that push data changes over an established WebSocket or persistent connection, so when any client updates a document, all subscribed clients receive the new data within milliseconds. Both services also provide offline persistence and automatic conflict resolution, making them ideal for collaborative apps where multiple users need their local state to stay consistent without custom polling logic.

Granting the Compute Instance Admin role with an IAM condition on `resource.location` restricts instance creation to only the `us-central1` region by evaluating the resource’s location attribute at request time. This satisfies the constraint that developers cannot create instances outside that specific region, using a native IAM condition rather than a separate organisational policy.

Elasticity is the cloud capability that automatically provisions and de-provisions compute, storage, or other resources to match current demand in real time. It relies on monitoring metrics (CPU, memory, request count) and autoscaling policies or services (e.g., Google Cloud Autoscaler, managed instance groups) to increase or decrease capacity without manual intervention. This directly fulfills the requirement to automatically add or remove resources, making it the correct choice.

Google Cloud's Penetration Testing Policy explicitly permits customers to conduct security tests on their own GCP resources—including Compute Engine VMs, GKE clusters, Cloud Functions, and App Engine applications—without prior notification or approval. This self-service authorization is subject to the Acceptable Use Policy (AUP), which prohibits testing that targets other customers' environments, Google's core infrastructure, or services outside the customer's own project boundaries. You are accountable for staying within your own resource scope and ensuring your tests do not degrade or disrupt Google's shared infrastructure, but you do not need to file a request or wait for permission before starting an assessment.

Cloud Functions is a serverless Function-as-a-Service (FaaS) platform that lets you deploy individual code functions that automatically run in response to events, including HTTPS requests. It removes all infrastructure management—no servers to provision, no operating systems to patch, and no runtime to install—because the platform handles execution, scaling, and availability. It scales from zero to thousands of concurrent invocations instantly and bills only for actual compute time during execution. This precisely matches the requirement to 'execute code in response to HTTP requests with no server management required'.

Hybrid cloud is a computing environment that connects an organization's on-premises infrastructure—such as a hospital's data center holding patient records—with a public cloud provider like Google Cloud, enabling data and workloads to move between them. For regulated industries like healthcare, this pattern allows sensitive data to remain on-premises for compliance and security while leveraging public cloud capabilities like AI-based imaging analysis for workloads that can be processed off-premises. The seamless orchestration across these two domains is the textbook definition of hybrid cloud.

Autoscaling automatically adjusts the number of VM instances in a managed instance group based on demand metrics such as CPU utilization, requests per second, or queue depth. When traffic spikes, autoscaling proactively or reactively provisions additional instances to maintain performance, then scales down during lulls to control cost. This makes it the correct mechanism for handling unpredictable e-commerce traffic spikes.

Separate projects per team, placed under a folder structure, enforce a clean resource hierarchy: each project is the primary billing boundary, so Cloud Billing reports and budget alert thresholds map directly to a team. Resource labels add a second dimension, enabling sub-team or product-level cost breakdowns through BigQuery billing export, which is the precise mechanism for granular chargeback. This approach preserves GCP-native elastic capacity and self-service while giving finance a structured, queryable view of spend.

During a live migration, the VM's memory pages are continuously copied from the source host to a destination host in a series of iterative passes, while the instance continues running its normal operations. At the final pass, the VM is briefly quiesced for just a few hundred milliseconds to transfer the remaining state, then the instance resumes on the new host with the same MAC address, IP address, and open network connections. This gives the appearance of zero downtime, though technically it's an extremely short pause rather than a full shutdown and boot.

Cloud Storage dual-region or multi-region classes are explicitly designed for geo-redundancy: they asynchronously replicate objects across two or more distinct geographic regions, automatically handling failover if one region becomes unavailable. This satisfies business continuity by providing a durable, independently accessible copy of data that survives regional outages without manual intervention, offering 99.99% availability and a zero-RPO replication model.

Canary deployment precisely matches the description: 5% traffic initially, monitoring, then gradual increase to 100%. The term comes from the mining practice of using canaries to detect dangerous gas — the canary deployment detects problems before full rollout.

Cloud TCO is built around pay-as-you-go fees for compute instances, managed storage like Cloud Storage volumes, and related services such as network egress or load balancing. These usage-based charges are direct line items on the cloud invoice and represent the actual cost of running workloads, so they are the core component of cloud TCO calculations. Sizing, region, and committed-use discounts all affect these fees.

Autoscaling automatically adjusts the number of VM instances in a managed instance group based on real-time signals like CPU utilization, request throughput, or custom metrics. It scales out during demand spikes and scales in during lulls, ensuring you only pay for the capacity that is actually needed at any moment. This dynamic, policy-driven approach directly supports fluctuating workloads without requiring long-term commitments or manual intervention.

The correct response is to map specific regulatory requirements to specific cloud controls. Data sovereignty → configure region constraints. Auditability → Cloud Audit Logs with immutable retention. Compliance → review applicable certifications (ISO 27001, SOC 2, FedRAMP). This addresses concerns with evidence rather than assumptions.

Cloud IDS is a managed intrusion detection service that uses packet mirroring in your VPC to copy traffic and apply deep packet inspection with threat signatures against full bidirectional flows, including outbound communications. Because it evaluates connections initiated from your workloads, it can detect command-and-control callbacks, outbound malware propagation, and data exfiltration attempts in near real time. This makes Cloud IDS the appropriate choice for detecting and alerting on suspicious outbound network behavior.

Dataflow, Google Cloud's fully managed stream and batch processing service, runs the job in batch mode using Apache Beam, automatically scaling workers based on input size and processing needs. It reads from Cloud Storage, applies the required transformation logic, writes to BigQuery with exactly-once semantics, and then scales to zero after completion, so you only pay for the active compute during those 2 hours.

Set up billing export to BigQuery. This is the correct approach because it automatically exports detailed usage and cost data into BigQuery, where you can run arbitrary SQL queries to slice the data by service, project, label, or time period. It provides complete, raw billing data for every resource, enabling deep custom analysis beyond what built-in dashboards offer, and supports building unique reports, trend analysis, and anomaly detection.

Implementing a cloud-native architecture with GKE, Cloud Build, and Cloud IAM directly supports the bank's speed and compliance objectives. GKE enables containerized microservices that can be independently scaled and updated, while Cloud Build automates the CI/CD pipeline, allowing new features to be deployed rapidly and consistently. Cloud IAM provides fine-grained access control with least privilege, and compliance auditing via Cloud Audit Logs creates an immutable, tamper-evident record of all operations, ensuring the bank can meet regulatory requirements while innovating. This combination of automation, isolation, and observability is the industry standard for regulated digital transformations.

When a budget threshold is exceeded, Cloud Billing publishes a message to a specified Pub/Sub topic. A Cloud Function subscribed to that topic can be triggered to call the Compute Engine API and stop instances, or use the Resource Manager API to disable projects, enforcing the budget automatically. This serverless, event-driven pattern gives near-immediate response and can be customized to stop only tagged resources, making it the correct choice for the stated requirement.

App Engine Standard Environment is a serverless platform that automatically scales your Node.js application from zero instances during idle periods to many during traffic spikes. It fully manages the underlying infrastructure, including load balancing, health checks, and runtime isolation, so you only pay for the resources your app actually consumes. This aligns perfectly with the startup's need for zero server management and cost efficiency under variable traffic.

Authorization is the IAM component that explicitly determines which actions a user is permitted to perform on a given set of resources. In Google Cloud, this is implemented by binding principals to roles, each containing a collection of permissions, and attaching those bindings to projects, folders, or organizations. The authorization engine evaluates the requested action against the effective allow policies and renders a definitive allow or deny decision.

Sustained use discounts are applied automatically to Compute Engine instances that run more than 25% of a billing month; the discount ramps up from 0% to 30% as utilization increases, requiring no upfront commitment or capacity reservation. Because this is assessed monthly based on actual run time per instance and region, it directly benefits workloads with unpredictable usage patterns, making it the only one of these options that adapts to usage without requiring a forecast or accepting termination risk.

This captures the transformation: millions of devices generating billions of readings enable entirely new business capabilities. Dynamic demand response programs, AI-driven grid optimization, personalized conservation recommendations, and real-time fault detection are all new revenue and efficiency opportunities created by the data at cloud scale.

Vertex AI, including its AutoML capabilities, is a unified managed machine learning platform that addresses the need for ML without in-house expertise. AutoML automates the entire model development pipeline: it handles data validation, feature engineering, architecture search, and hyperparameter tuning, then automatically deploys the trained model to a scalable serving endpoint. Users simply upload labeled data and specify the objective, and the platform manages the infrastructure. This makes Vertex AI the correct choice for a company that wants to leverage ML models with minimal manual involvement and no dedicated data science team.

Adopting open standards such as Kubernetes for orchestration, containerized workloads for packaging dependencies, and a multi-cloud or hybrid architecture to distribute risk directly addresses the root cause of cloud lock-in: proprietary APIs and data gravity. Containers run consistently across any CNCF-compliant cluster, while SQL-compatible databases and open protocols (e.g., OIDC, S3) let teams migrate components between providers without rewriting code. This preserves the ability to consume high-value cloud services (managed AI, analytics, serverless) while retaining the architectural freedom to move workloads when business, cost, or compliance needs change.

Archive is the lowest-cost storage class in Cloud Storage, purpose-built for long-term archival where data is accessed less than once a year. Its 365-day minimum storage duration aligns exactly with the retention policy; because the data is kept for 365 days, there is no early-deletion penalty. While retrieval costs are higher, the once-per-year access pattern makes these costs negligible, resulting in the lowest total cost of ownership.

Assured Workloads is the correct foundation because it enforces data residency by pinning resources to a selected region and imposes access restrictions such as preventing Google personnel from accessing customer data without explicit approval. Access Transparency complements it by providing detailed, audit-ready logs of any Google employee access actions, satisfying the regulatory need for both enforcement and accountability. This pairing directly addresses location restrictions and personnel access tracking, which are the core requirements.

Dataflow is exactly right: serverless (no infrastructure management), supports both streaming (from Pub/Sub) and batch, applies transformations and aggregations, and writes natively to BigQuery. The Pub/Sub → Dataflow → BigQuery pattern is one of the most common data engineering pipelines on Google Cloud.