mediumMultiple ChoiceObjective-mapped
How to Enforce Data Residency Using Organization Policy Resource Location Constraint
A government agency requires that all compute resources for a project are physically located in the United States (US) to comply with FedRAMP. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Which configuration ensures that all future resources are created in the US?
Quick Answer
The correct answer is to set an Organization Policy on the folder containing the project with the constraint `constraints/gcp.resourceLocations` configured to an allowedLocations list of US regions. This works because the resource location constraint is a list policy evaluated at resource creation time, blocking any Compute Engine, Cloud Storage, or BigQuery resource from being provisioned outside the specified geographic boundaries, thereby enforcing data residency for FedRAMP compliance. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of hierarchical policy inheritance and the distinction between organization policies and IAM permissions—a common trap is confusing this with a VPC Service Controls perimeter or a simple region restriction on a single service. Remember the memory tip: “Location lock at the folder, not the project—think ‘folder first, resource last’ to avoid missing the inheritance chain.”
⚠ Common exam trap
Google Cloud often tests the misconception that IAM roles or VPC controls can enforce resource location, when in reality only Organization Policy constraints provide that enforcement at creation time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.
The Organization Policy constraint `constraints/gcp.resourceLocations` enforces that all future resources in the project (Compute Engine instances, Cloud Storage buckets, BigQuery datasets) are created only in the allowed US regions. This policy is evaluated at resource creation time and prevents any resource from being provisioned outside the specified locations, directly meeting the FedRAMP requirement for physical location in the US.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure VPC Service Controls with a perimeter that only allows access from US-based IP addresses.
Why it's wrong here
VPC Service Controls control data access, not resource creation location.
- ✗
Assign the Compute Admin role to a security admin and restrict them to only create resources in US regions.
Why it's wrong here
IAM roles do not have fine-grained location constraints.
- ✓
Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.
Why this is correct
This policy restricts resource creation to specified locations, applicable to all resources in that folder.
- ✗
Use Cloud KMS with a key from a US-based location and require that all resources use that key.
Why it's wrong here
KMS key location does not enforce where the resources are created.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?
medium- A.Add a label to the Cloud Run service specifying the region and rely on developers to follow it.
- ✓ B.Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.
- C.Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.
- D.Configure VPC Firewall rules to only allow egress to EU IP addresses.
Why B: Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.