PCSE Ensuring Data Protection Practice Question
An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?
⚠ Common exam trap
Google often tests the distinction between IAM conditions (which control who can act) and organization policies (which control what can be done), leading candidates to choose IAM conditions when the question asks for a blanket enforcement across all users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.
Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the roles/storage.admin IAM role with a condition that restricts region.
Why it's wrong here
IAM conditions cannot restrict creation region.
- ✗
Use Assured Workloads to enforce data residency.
Why it's wrong here
Assured Workloads is for compliance frameworks, not simple location restriction.
- ✗
Define a bucket policy that allows only europe-west1.
Why it's wrong here
Bucket policies control access, not creation location.
- ✓
Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.
Why this is correct
This constraint restricts where resources can be created.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.