Cloud Digital Leader Trust and security with Google Cloud Practice Question
A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?
⚠ Common exam trap
The GCDL exam often tests the distinction between network-level controls (like Cloud Armor) and data residency controls (like org policies), leading candidates to mistakenly choose a security tool that blocks traffic rather than a policy that restricts resource location.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.
The `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.
Why this is correct
Selecting EU regions for every resource ensures that data at rest is physically stored within EU boundaries, directly meeting residency requirements. Applying the gcp.resourceLocations organization policy adds a preventive control that blocks creation of any resource outside the allowed EU regions, even by accident or through a misconfigured deployment. This combination of explicit region selection and org-level policy enforcement is the accepted GCP method for guaranteeing data residency across all projects in an organization.
- ✗
Enable Cloud Armor on all load balancers to block non-EU traffic.
Why it's wrong here
Cloud Armor is a web application firewall and DDoS protection service that filters incoming requests based on IP address, geo-location, or other attributes. It can block traffic from non-EU IP ranges, but it has no ability to influence where Google stores the data that the application processes or writes. Even if all client requests originate from the EU, the underlying compute and storage resources could still be provisioned in non-EU regions, so this does not enforce data residency.
- ✗
Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.
Why it's wrong here
HTTPS encryption via TLS protects data in transit between the client and Google's edge, but it does not control where that data is ultimately stored or processed. Once the encrypted data reaches a GCP service, it can be persisted to a disk in any region, including outside the EU. Data residency requirements mandate the geographic location of data at rest, not just confidentiality during transmission, so HTTPS alone cannot satisfy this compliance need.
- ✗
Enable Google Workspace's regional storage settings to restrict where emails are stored.
Why it's wrong here
Google Workspace's regional storage settings only govern where Workspace application data such as Gmail messages and Drive files are stored; they have no effect on GCP infrastructure services like Compute Engine, Cloud Storage, or BigQuery. GCP data residency is enforced independently through per-service region selection and the gcp.resourceLocations org policy, not through Workspace admin console settings. Relying on Workspace settings would leave your GCP resources—which are often the actual systems of record—unconstrained to be created in any region.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.