CCNA Cdl Google Cloud Security Questions

VPC Service Controls is correct because it establishes security perimeters around Google Cloud resources such as Cloud Storage, BigQuery, and Cloud Bigtable. These perimeters restrict data movement by allowing only requests that originate from authorized projects, networks, and identities within the perimeter. This API-level control prevents data exfiltration even if credentials are compromised, going beyond what network-level firewalls can achieve.

Chronicle is Google Cloud's SIEM offering that ingests large volumes of telemetry and log data, normalizes it, and applies analytics and detection rules to identify suspicious activity. It correlates events across multiple data sources with context like user and network behavior, enabling security teams to prioritize and respond to threats. As a SIEM, Chronicle is designed specifically for centralized security analytics and incident investigation.

Secret Manager is Google Cloud's dedicated service for storing secrets like database passwords, API keys, and certificates. It provides versioned secret values, fine-grained IAM roles, and Cloud Audit Logging to track access, and it supports rotation policies by using Cloud Scheduler to create new versions. Unlike the other options, Secret Manager handles the password directly and offers the necessary controls for secure retrieval by applications.

Cloud Armor is Google Cloud's web application firewall (WAF) that filters HTTP/HTTPS traffic at the edge before it reaches your application. Its pre-configured WAF rules along with custom expressions block common web exploits such as SQL injection, cross-site scripting, and OWASP Top 10 threats. It also supports IP reputation lists, geo-blocking, and DDoS mitigation, delivering real-time protection for public web applications.

Attaching a dedicated service account to the Compute Engine instance is the recommended keyless approach. The metadata server automatically provides OAuth2 access tokens to the instance, so the application code can implicitly use the attached identity to authenticate to Google Cloud APIs. Granting only the required IAM roles on the bucket (e.g., Storage Object Viewer) follows least privilege, and because no private key ever leaves Google's infrastructure, credential rotation and expiry are handled automatically by the platform.

CMEK lets you create and manage your own keys within Cloud KMS, giving you control over the full key lifecycle—rotation schedules, enables/disables, and deletions—while still leveraging Google's infrastructure for storage and encryption operations. You can grant and revoke access to keys via IAM, and audit key use with Cloud Audit Logs. This directly satisfies the need to manage keys as the customer, because you retain administrative authority over the key material that protects the data.

Security Command Center (SCC) is the correct choice because it provides a unified security management platform that continuously scans GCP resources for misconfigurations, vulnerabilities, and compliance violations. It aggregates findings from built-in detectors, integrates with services like Cloud Asset Inventory, and offers a dashboard with actionable insights and risk scores. This directly enables a security team to identify and remediate configuration weaknesses across the organization.

BeyondCorp Enterprise is Google's fully integrated zero-trust solution that replaces the corporate VPN with identity- and context-aware access. It combines IAP with continuous device posture verification via Endpoint Verification, adaptive risk scoring, data loss prevention, and a centralized policy management console. BeyondCorp also offers a global 'kill switch' to instantly revoke access for any user or device, enabling security teams to enforce granular, zero-trust policies based on user identity, device state, and environmental context.

Chronicle is a cloud-native security information and event management (SIEM) platform designed specifically for ingesting, normalizing, and analyzing large volumes of security logs. It provides built-in threat detection, correlation rules, and fast search for threat hunting, making it the correct choice for a security analyst who needs to perform large-scale log analysis. Unlike general-purpose log or data tools, Chronicle is purpose-built for security operations, with features like detections, timelines, and retroactive analysis.

Secret Manager is the correct choice for storing and managing database passwords because it is a dedicated secrets-management service that provides versioning, fine-grained IAM permissions, and audit logging for each secret access. It encrypts secret values in transit and at rest, and integrates seamlessly with Compute Engine, GKE, Cloud Run, and Cloud Functions so applications can retrieve secrets at runtime via a simple API. This avoids hardcoding credentials and supports easy rotation.

Identity-Aware Proxy (IAP) is the correct answer because it implements zero-trust access control at the application layer. When a user requests the internal web app, IAP uses OAuth-based authentication to verify their identity and validates contextual signals such as device security status, IP address, and geographic location. It then enforces fine-grained IAM roles (e.g., the 'IAP-secured Web App User' role) to allow or deny each session, providing user-centric access without exposing the entire VPC.

Chronicle is Google Cloud's cloud-native SIEM purpose-built for ingesting massive volumes of security telemetry, normalizing it, and running continuous threat detection. Unlike simpler log tools, it provides automated correlation, an entity graph, and detection rules that enable security teams to hunt for and investigate threats. It integrates with Cloud Logging and other sources, making it the correct choice for security log monitoring and analysis.

Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service. It enforces L7 filtering rules—such as the OWASP ModSecurity Core Rule Set for SQLi and XSS, rate limiting, and custom expressions—at the edge of Google's global load balancing and Cloud CDN infrastructure. In addition, it provides always-on network-layer DDoS mitigation, making it the correct answer for protecting a GKE-hosted web app. It can be configured with preconfigured rules or tailored to block specific attack signatures.

Identity-Aware Proxy (IAP) sits in front of HTTPS applications and evaluates each connection using Google credentials and additional context like IP address, geolocation, and device security posture before granting access. It enforces fine-grained role-based policies per resource, eliminating the need for a full VPN for remote users. IAP also supports TCP forwarding for SSH/RDP, so it can directly replace VPN for administrative access to VMs.

Identity-Aware Proxy (IAP) enforces zero-trust access by intercepting requests to applications and verifying the user's identity and contextual attributes, such as device security and network origin, against Cloud IAM policies. It applies least-privilege principles at the application layer, allowing only authenticated and authorized users to reach resources. IAP is a key building block for zero trust because it turns access decisions from network-based to identity-based.

roles/storage.objectViewer grants storage.objects.get and storage.objects.list, which allow the VM to read object contents and list objects within a bucket without any write, delete, or admin permissions. This precisely matches the requirement of only reading from Cloud Storage and follows least privilege by not granting any unnecessary capabilities.

Cloud CDN serves as a caching layer that shields backend origins by absorbing requests and can deliver cached content globally with low latency. When integrated with Cloud Armor, CDN policies evaluate incoming requests against WAF rules before they reach the origin, making it a valid component in a protection strategy; however, the WAF itself is Cloud Armor, not CDN.

Secret Manager is the correct choice because it is a dedicated, purpose-built service for storing and managing sensitive data such as API keys, passwords, and certificates as immutable secret versions. It provides fine-grained IAM roles, automatic log-based auditing, built-in rotation with etag validation, and integration with App Engine, Cloud Functions, and Kubernetes workloads. You can upload certificate data directly as a secret payload and access it securely via the Secret Manager API or client libraries, giving the developer exactly the managed workflow they need.

Google Cloud mandates TLS (HTTPS) for every external call to its public API endpoints, covering services like BigQuery and Cloud Storage. This requirement is enforced at the infrastructure level, so clients must use TLS to communicate, regardless of the client library or SDK. As a result, data confidentiality and integrity are protected from the client to Google's edge, and users do not need to configure certificates themselves.

Security Command Center is the central security and risk management platform for Google Cloud, aggregating findings from built-in and third-party services, including Security Health Analytics, Event Threat Detection, Cloud Asset Inventory, and Cloud Armor. It gives security teams a single pane of glass to view vulnerabilities, misconfigurations, and active threats across all projects. This service includes preset compliance metrics, malware discovery, and integration with Google Cloud's Web Security Scanner and partner solutions. Its role as the unified findings hub is exactly why it is the recommended solution for threat detection and response at cloud scale.

Granting the Compute Instance Admin role with an IAM condition on `resource.location` restricts instance creation to only the `us-central1` region by evaluating the resource’s location attribute at request time. This satisfies the constraint that developers cannot create instances outside that specific region, using a native IAM condition rather than a separate organisational policy.

Cloud IDS is a managed intrusion detection service that uses packet mirroring in your VPC to copy traffic and apply deep packet inspection with threat signatures against full bidirectional flows, including outbound communications. Because it evaluates connections initiated from your workloads, it can detect command-and-control callbacks, outbound malware propagation, and data exfiltration attempts in near real time. This makes Cloud IDS the appropriate choice for detecting and alerting on suspicious outbound network behavior.

Authorization is the IAM component that explicitly determines which actions a user is permitted to perform on a given set of resources. In Google Cloud, this is implemented by binding principals to roles, each containing a collection of permissions, and attaching those bindings to projects, folders, or organizations. The authorization engine evaluates the requested action against the effective allow policies and renders a definitive allow or deny decision.

Assured Workloads is the correct foundation because it enforces data residency by pinning resources to a selected region and imposes access restrictions such as preventing Google personnel from accessing customer data without explicit approval. Access Transparency complements it by providing detailed, audit-ready logs of any Google employee access actions, satisfying the regulatory need for both enforcement and accountability. This pairing directly addresses location restrictions and personnel access tracking, which are the core requirements.

Secret Manager is the purpose-built Google Cloud service for storing API keys, database passwords, certificates, and other sensitive configuration data. It maintains immutable secret versions, supports granular IAM roles and conditions (e.g., accessor, giver, view access to a specific secret version), and is natively integrated with Cloud Audit Logs so every access to a secret's plaintext is recorded. You can automate rotation by using Cloud Functions or Cloud Scheduler to regenerate the secret value and add a new version, and then grant applications access only to the active version. It is the only option here that directly satisfies the requirements for secure storage, rotation, and auditing of manage to manage runtime secrets.

CMEK allows you to create and manage key material in Cloud KMS and assign it as the key that encrypts Cloud Storage objects through a key ring and CryptoKey. You retain lifecycle control—enabling, disabling, rotating, or destroying the key—and every encryption or decryption operation under that key is recorded as a Cloud KMS operation in Cloud Audit Logs, giving you the auditability needed for security monitoring and forensic investigation.

Customer-supplied encryption keys (CSEK) are keys that the customer generates and provides directly to Google Cloud via API when writing data. Google's systems use the customer-supplied key to encrypt the data at rest and then destroy the key from its memory, ensuring that Google does not retain the key material. This aligns with the company's requirement because the customer retains exclusive control over the key, and Google cannot access the plaintext without the customer re-supplying the key, making it the correct choice.

Identity-Aware Proxy (IAP) is a Google Cloud service that sits in front of your applications and proxies every request, enforcing access control based on the requester's identity, group membership, and contextual attributes such as IP address, device security status, and geolocation. Because it operates at the application layer (HTTP/S or TCP) rather than the network layer, it can grant or deny access to individual resources without changing your network topology or requiring a VPN. IAP is the core enforcement point for a BeyondCorp-style zero-trust architecture, enabling context-aware, least-privilege access to both web applications and SSH/RDP services.

Ingress rules specify allowed sources, such as the VPC.

Cloud Armor is a security policy service for HTTP(S) load balancers that combines both network-layer DDoS protection and a Web Application Firewall (WAF) with Layer 3-7 filtering. It enforces allow/deny rules at the edge, including preconfigured rules for OWASP Top 10 risks such as SQL injection and cross-site scripting, and scales to absorb volumetric DDoS attacks. Because it operates inline on incoming traffic, it actively blocks malicious requests before they ever reach the application, making it the correct choice for protecting a web application from DDoS and SQL injection.

Chronicle is a cloud-native SIEM from Google Cloud designed to ingest, normalize, and analyze security logs from multiple cloud providers, on-premises systems, and SaaS applications. Its architecture leverages BigQuery for scalable log storage and provides advanced threat detection, retroactive analysis, and custom detection rules with low-latency searching. As a Google Cloud product purpose-built for security log analytics, it directly addresses the need to monitor and analyze logs across a multi-cloud environment.

CMEK in Cloud KMS lets you create and control a key that Cloud SQL automatically uses for encrypting data, backups, and logs at rest. You control key rotation, enabling/disabling, and access via IAM, and Cloud KMS records key usage for auditing. This gives the required customer control while keeping transparent, automatic encryption.

Access Transparency is the correct feature because it provides real-time logs of every action taken by Google personnel (and certain subprocessors) when accessing customer content, including reads, writes, and administrative operations. It complements Cloud Audit Logs by covering the 'Google-side' of the shared responsibility model, which no other logging option addresses. It must be explicitly enabled on the organization, folder, or project, and it works only for a defined set of Google Cloud services.

BeyondCorp Enterprise is Google's zero-trust access solution that fully replaces a VPN-based remote access model. It grants users access to specific applications based on verified identity, device trust, and context (such as location and security posture) rather than opening up network-level connectivity. This eliminates the implicit trust and lateral movement risks inherent in traditional VPNs, while also integrating with Google Cloud's security capabilities like DLP and threat detection.

Cloud IDS is a fully managed intrusion detection service that performs deep packet inspection (DPI) on all network traffic within a VPC, including both east-west and north-south flows. It leverages the industry-leading threat signatures from Palo Alto Networks to detect malicious payloads, command-and-control communications, and other network-based attacks. By comparing packet payloads against known signatures, Cloud IDS provides real-time visibility into actual traffic content, directly meeting the requirement to analyze network traffic for threats.

VPC Service Controls with an access level that includes the IP range is correct because these perimeters restrict all API calls to protected services like Cloud Storage, and access levels apply context-aware conditions (including source IP address) at the Google Front End. When you add Cloud Storage to a service perimeter and attach an access level with your allowed CIDR range, any API request originating outside that IP range is denied, regardless of IAM permissions. This gives you perimeter-based, context-sensitive enforcement directly on the Cloud Storage API.

Operational security is correct because it encompasses the day-to-day processes and controls that protect systems, including user access management (authentication, authorization, least privilege), vulnerability management, continuous monitoring, and incident response. These are precisely the measures described in the question—access control lists and intrusion detection—which require ongoing operational discipline rather than static architectural safeguards. This layer ensures that policies and procedures are executed consistently across the environment.

Cloud HSM is a fully managed hardware security module that provides FIPS 140-2 Level 3 validated protection for cryptographic keys. When used with Cloud KMS, Cloud HSM services generate and store customer-managed keys within tamper-resistant hardware, ensuring keys never leave the HSM boundary while enabling encryption of data at rest across Google Cloud services. This directly meets the requirement for the company to control keys with hardware-backed security and simplifies compliance.

VPC Service Controls create perimeters around Google Cloud APIs and services, using context such as identity, source IP, and resource metadata to authorize access. This prevents copying or moving data from within the perimeter to external destinations, directly reducing the risk of data theft. By working at the API layer, it complements IAM and network controls with a data-boundary layer.

Access Transparency is the correct control because it provides near real-time, read-only audit logs specifically for actions taken by Google personnel against customer data. These logs capture each instance of access (e.g., when a Google engineer troubleshoots a support issue) and are viewable in Cloud Logging. Unlike standard audit logs, Access Transparency is designed solely for visibility into Google's own staff activity, making it the exact mechanism for this requirement.

Allows developers to use service accounts with instances.

Cloud Armor is a web application firewall (WAF) and distributed denial-of-service (DDoS) protection service that runs at Google's network edge. It provides preconfigured and customizable rules to block SQL injection, cross-site scripting, and other OWASP Top 10 attack vectors before they reach your application. By integrating with Cloud Load Balancing and offering ML-based adaptive protection, Cloud Armor actively filters malicious requests and safeguards your web application from application-layer and volumetric attacks.

Identity-Aware Proxy (IAP) enforces Zero Trust by brokering access to applications and resources based on the requester's identity and context, rather than their network location. It authenticates users via OAuth, checks IAM policies, and can be combined with context-aware conditions before proxying the connection. This ensures that even if a request originates from inside the VPC, it is only allowed if the user is verified and authorized, eliminating the need for a traditional VPN.

Chronicle is a fully managed, enterprise-grade SIEM (Security Information and Event Management) solution on Google Cloud. It ingests petabytes of log and telemetry data, performs high-speed search without traditional indexing, and applies detection engines and threat intelligence to uncover malicious activity, enabling security analysts to hunt, investigate, and respond to threats. Its native integration with other Google Cloud services makes it the only option here that is a dedicated SIEM, rather than a component or adjacent security tool.

Data security is the Google Cloud layer that directly protects the data itself using encryption at rest and in transit, customer-managed encryption keys (CMEK), and data loss prevention APIs for classifying and redacting sensitive information. It is the only option that explicitly addresses how stored data is encrypted and how access to that encrypted data is managed. Google Cloud encrypts data at rest by default, and the data security layer governs key management, cipher suite selection, and rotation policies.

Customer-Managed Encryption Keys (CMEK) with Cloud KMS let you create, rotate, and disable keys directly within Google Cloud while retaining full control. Each encryption/decryption operation is logged to Cloud Audit Logs, providing detailed visibility into who used the key. You can set automatic rotation periods and restrict key usage via IAM, making it the natural choice to enforce the organization's data governance requirements.

IAM Recommender leverages Google Cloud's usage data and machine learning to analyze each principal's actual permissions usage over the past 90 days, then generates role recommendations that remove unnecessary permissions and flags over-privileged accounts. It surfaces findings like role churn or unused roles, and supports applying the suggested least-privilege bindings directly or via Terraform, enabling continuous, data-driven remediation of excessive IAM permissions without disrupting existing workflows.

Sensitive Data Protection (formerly Cloud DLP) is the correct service because it provides native data discovery, classification, and de-identification. You can create inspect jobs that scan Cloud Storage buckets using predefined or custom infoTypes to detect sensitive data like credit card numbers, names, or addresses. It supports both full scans and time-based sampling, and integrates with other security services for remediation.

Cloud KMS is the correct choice because it is the Google Cloud service purpose-built for creating, storing, and managing encryption keys. It supports symmetric and asymmetric keys, automatic rotation, and fine-grained IAM controls, and it integrates with Cloud Storage, BigQuery, Compute Engine, and other services for seamless data encryption. Keys are kept in a centralized, secure environment, and you can use them to encrypt and decrypt data without exposing the raw key material.

Setting default encryption on a bucket to use a CMEK key from Cloud KMS is the correct action because it applies a customer-managed key to all new objects automatically, giving you control over key lifecycle, rotation, and permissions. This configuration satisfies the requirement for persistent, customer-controlled encryption without forcing per-request key management, and it integrates with Cloud KMS for auditing and access management.

Cloud Audit Logs records both admin activity and data access events, including every call to decrypt data with a Cloud KMS key. By enabling Data Access audit logs for Cloud KMS, the organization gains a detailed trail of who accessed which key, when, and from what context, enabling anomaly detection and compliance audits. This visibility is essential for verifying that key rotation policies are enforced and that keys are not misused.

Keys must be created in Cloud KMS before use.

VPC Service Controls create security perimeters around Google Cloud services like Cloud Storage, restricting which networks, IP ranges, and identities can invoke their APIs. It enforces a context-aware boundary at the service level, preventing data exfiltration and unauthorized access even if an IAM policy is misconfigured. When the goal is 'only API calls from within', VPC Service Controls are the correct mechanism because they block access from outside the defined perimeter regardless of IAM permissions.

Enabling automatic rotation with a 90-day period configures Cloud KMS to create a new primary key version every 90 days. All future Cloud Storage objects encrypted with this CMEK will use the new primary version, while older objects remain readable via their original key versions, which stay enabled for decryption. This satisfies the rotation requirement without forcing a rewrite or copy of existing data, since each key version is cryptographic material that can be retired on a future schedule.

Authorization is the IAM concept that determines exactly what actions a specific principal is allowed to perform on a resource. It evaluates the existing policies, permissions, and conditions (e.g., IP address, time, or MFA state) to decide whether to allow or deny an operation. Thus, authorization is the fundamental control point that answers the question: "Can this user do this action?"

Cloud Audit Logs are the native audit trail for Google Cloud, capturing Admin Activity, Data Access, and System Event records that answer who performed an action, on what resource, when, and from where. Admin Activity logs are enabled by default and include all control-plane API calls, such as creating a project, updating IAM policies, or deleting a service — exactly the 'all actions performed by administrators' requirement. These logs are immutable and can be exported to Cloud Storage or BigQuery for long-term retention and compliance analysis.

Allows viewing dataset metadata and querying data.

The Compute Engine default service account is automatically attached to the instance and is authenticated through the instance metadata server, so no key file is needed. Granting it the roles/run.deployer role gives the pipeline permission to create and update Cloud Run services that run in the same project, while adhering to the principle of least privilege and avoiding long-lived credentials. This is the recommended pattern for workloads running on Compute Engine that need to deploy Cloud Run resources.

Security Command Center is Google Cloud's built-in security and risk management platform that automatically discovers and aggregates security findings from over 100 integrated services, including Event Threat Detection, Container Threat Detection, and VPC Service Controls. It provides a single-pane-of-glass dashboard for vulnerabilities, threat detections, and policy misconfigurations across the organization, with APIs for custom integrations and automated remediation. This makes it the appropriate tool for detecting and responding to threats across GCP.

Mandiant is Google Cloud's front-line threat intelligence and incident response unit, offering curated cyber threat intelligence, threat actor research, and on-demand incident response consulting. Its services include digital forensics, compromise assessments, and strategic intelligence, making it the direct match for this question's description of providing threat intelligence and incident response.

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform, and it provides built-in vulnerability scanning for Compute Engine VMs and GKE container images. It aggregates findings from native Google Cloud services and partner security tools into a single view, then uses severity scores, exposure data, and attack path simulation to help security teams prioritize which vulnerabilities to remediate first. This directly matches the requirement to detect and prioritize vulnerabilities across a cloud environment.

Data security is the correct layer because it directly protects the confidentiality and integrity of the data itself through encryption. Google uses TLS for data in transit and AES-256 (or stronger) for data at rest, managed via Cloud KMS. This layer also includes key management, data classification, and DLP policies.

Mandiant is Google Cloud's managed threat detection and response service, combining front-line expertise from Mandiant's incident response consultants with automated threat hunting and forensic capabilities. It is purpose-built for investigating advanced persistent threats, containing breaches, and performing root cause analysis, unlike logging or network filtering services. This makes Mandiant the direct match for a security team's requirement to detect and respond to sophisticated threats.

The roles/pubsub.publisher role contains exactly the pubsub.topics.publish permission required to send messages to a topic. Attaching this role as a binding on the specific topic resource restricts the grant to that single topic, so the service account cannot publish to any other topics in the project. This is the least-privilege approach because it grants the minimal permission on the narrowest resource scope that still fulfills the requirement.

Cloud Secret Manager is the native Google Cloud service designed specifically to store and manage API keys, passwords, and other sensitive strings. It provides centralized IAM-based access control, automatic secret versioning, configurable rotation policies, and full audit logging via Cloud Audit Logs. Secrets can be encrypted with customer-managed keys (CMEK) using Cloud KMS, and the service integrates with Compute Engine and GKE for runtime secret injection. This combination of fine-grained access, lifecycle management, and integration makes it the correct and secure choice.

Cloud Armor is the correct choice because it combines distributed denial-of-service (DDoS) protection with a web application firewall (WAF) at the Google Cloud edge. It offers preconfigured rules for the OWASP Top 10, including SQL injection (SQLi) and cross-site scripting (XSS), and can enforce these rules inline as traffic passes through Cloud Load Balancing. Cloud Armor also provides adaptive protection, rate limiting, and edge security policies to mitigate volumetric DDoS attacks. This dual capability directly addresses both the DDoS and SQL injection threats described in the scenario.

Principle of least privilege is the security doctrine mandating that any user, process, or system component be granted only the minimum permissions essential to perform its prescribed functions. By restricting privileges to the exact scope of job duties, it minimizes the attack surface and contains the blast radius of a compromised credential, preventing lateral movement or unauthorized data access. This principle is foundational to access control and directly answers the question about how much permission a user should receive.

Access Transparency is the correct service because it provides logs of actions taken by Google personnel (e.g., Cloud Support or Site Reliability Engineers) on the content of your data and the metadata of your resources. It uses the same audit log framework but specifically surfaces events where Google staff access customer data, and it distinguishes these from customer-initiated API calls. Administrators can route these logs to Cloud Logging or Pub/Sub to set up alerts, giving the security team the exact visibility they need into human access by Google employees.

BeyondCorp Enterprise is Google Cloud's complete zero-trust access solution, designed to replace a traditional VPN. It enforces access decisions based on user identity, device security posture, and context, rather than granting broad network-level entry. By combining Identity-Aware Proxy, endpoint verification, and adaptive policies into a single platform, it protects applications without exposing the entire network, which is why it is the correct replacement for VPN-based remote access.

VPC Service Controls define security perimeters around Google Cloud resources such as Cloud Storage and BigQuery, using context-aware access conditions (identity, IP, device) to block data exfiltration. It works at the API layer, independent of VPC network boundaries, and is the only option here that actively restricts data movement outside a defined perimeter.

The organization policy constraint `gcp.resourceLocations` is the correct mechanism because it actively enforces geographic compliance at resource creation time. By defining an allowlist of permitted locations at the organization, folder, or project level, Google Cloud blocks any attempt to create a resource outside those regions. This is a centralized, context-aware enforcement that works across supported services, making it the native, authoritative way to guarantee workloads run only in mandated locations.

The Data Loss Prevention (DLP) API is specifically designed to inspect, classify, and protect sensitive data by scanning content for predefined infoTypes (e.g., names, credit card numbers, national ID numbers) and custom patterns. It can analyze text, structured data, and even images via OCR, then classify findings and optionally apply de-identification transformations like redaction or tokenization. This makes it the correct service for identifying and classifying sensitive data.