PCSE Ensuring Data Protection Practice Question
A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?
⚠ Common exam trap
Many exam-takers confuse data exfiltration controls (like VPC Service Controls) with data residency controls (like organization policy constraints), leading them to choose a tool that prevents data from leaving a network rather than one that restricts where resources can be physically located.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.
Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC Service Controls to prevent data exfiltration.
Why it's wrong here
VPC Service Controls prevent data exfiltration but do not restrict resource creation location.
- ✗
Set IAM conditions on all resources to allow only US regions.
Why it's wrong here
IAM conditions cannot restrict resource creation location.
- ✓
Configure an organization policy with gcp.resourceLocations as part of the Assured Workloads configuration.
Why this is correct
Assured Workloads can enforce location constraints via organization policies.
- ✗
Use Cloud DLP to scan and block data leaving the US.
Why it's wrong here
Cloud DLP is for data inspection, not residency enforcement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.