Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enabling HTTPS for all data transmission to ensure data is encrypted during transfer

  Why it's wrong here

  HTTPS encryption (TLS) protects data while it is moving between a client and Google services, but it does nothing to restrict where that data is stored or processed at rest. GDPR data residency requirements are about the geographic location of data storage and processing, not the confidentiality of the transmission channel. A resource could still be created in a non-EU region, and data could still be transferred to those regions, with HTTPS fully enabled. This control addresses a completely different concern (data in transit security) and fails to enforce any residency boundary.

• ✓

  Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google

  Why this is correct

  This combination addresses GDPR data residency: org policy constraints prevent resources from being created outside EU regions; VPC Service Controls prevent data from being read out of the EU perimeter; the DPA provides contractual compliance assurance. Together they form a comprehensive GDPR data residency control framework.

• ✗

  Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure

  Why it's wrong here

  CMEK gives customers control over the cryptographic keys used to protect data at rest, but it does not control or restrict the geographic location where the data or the keys reside. Keys stored outside Google's infrastructure, or in a different region, do not prevent Google from storing or processing the actual data in non-EU regions; encryption keys and data are logically separate resources. CMEK addresses data confidentiality against unauthorized access, not data residency or jurisdictional boundaries. GDPR residency is about where the data is physically stored and processed, not who manages the keys, so this option fails the core requirement.

• ✗

  Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers

  Why it's wrong here

  Training developers and requiring manual approval are procedural controls that depend on human vigilance and are prone to error, delay, and bypass. In a large organization with many developers, manual review of every cross-region transfer does not scale and cannot guarantee consistent enforcement of GDPR residency requirements. Technical controls such as organization policy constraints and VPC Service Controls automatically and prohibitively block disallowed actions, whereas a manual approval process is advisory and can be overridden or ignored. This option also does not provide the contractual GDPR accountability that a Data Processing Agreement establishes.

Go deeper

Related to this question