CCNA Data Governance And Compliance Questions

Data region policies in Google Workspace apply to data at rest for covered services, but they do not automatically migrate existing data. When you set a data region, only newly created data will be stored in the specified region. Existing data remains in its original location unless you request a migration. This is a common oversight when implementing data regions.

A Google Vault retention rule preserves messages independently of the user's mailbox, so emptying Trash cannot remove them before the three-year period expires. Vault holds data at the archive layer, satisfying the stem's requirement that deletion survive user action.

Context-Aware Access evaluates device security posture, such as screen lock and encryption, as an access-level condition. This satisfies the stem's requirement for a commonly configured security setting, since posture signals determine whether a device may reach Workspace apps.

In Google Vault, when you place a hold on a user's account for specific services, the hold applies to all existing and future data in those services until the hold is removed. Adding the user to the hold ensures that new emails and files are automatically preserved. No further action is needed.

This setting explicitly disables download, print, and copy for shared files.

A Vault hold preserves all data by placing the user's mailbox and Drive content on indefinite retention, so deletion attempts are blocked until the hold is removed. This satisfies the stem's constraint that the account is under hold, where preservation overrides normal deletion and retention policies.

Google Vault applies a retention rule or legal hold directly to the specified user's mailbox, preserving every message regardless of deletion by the user. This satisfies the legal team's audit requirement, since held content remains searchable and exportable until the matter is closed or the hold is removed.

Drive DLP rules can detect sensitive content like credit card numbers using predefined detectors. Setting the action to 'Alert and log' will trigger an alert and log the event without blocking the file creation or sharing. This meets the requirement to scan and log without impeding users.

DLP rules inspect outbound email content for sensitive data patterns, such as credit card numbers, and block or quarantine messages that match. Configuring them in Google Workspace directly satisfies the requirement to prevent employees sending card numbers through Gmail, enforcing protection at the message level before delivery occurs.

Vault lets administrators search across Gmail, Drive, Meet and other services by user, date and term, then export the matching data for legal or investigative purposes. Search and export is a core Vault function the question asks for.

Vault Admin is a predefined role that grants access to Google Vault for eDiscovery and legal holds, but does not include permissions to modify Workspace settings or access user passwords. It is specifically designed for legal and compliance teams who need to search and preserve data without administrative control over the Workspace environment.

Vault retention rules can cover Gmail messages, holding them for a set period or indefinitely regardless of user deletion. This satisfies the stem's requirement to name three supported data types, alongside Drive and Hangouts/Meet records.

Drive audit events in the Admin Console capture the actor, target file, recipient, and timestamp for external shares. By setting the log retention period for Drive to three years, the firm meets both the content and the retention requirement without exporting data to a third party.

Email log search queries message delivery across all recipients, including external domains, and reports the delivery status per message. This satisfies the need to confirm whether a specific email reached an external address, which mailbox-level views cannot show.

Drive labels provide a structured way to classify files, such as marking them with sensitivity levels. When combined with DLP, labels can be automatically applied based on content. The label itself is a metadata field that can be used for policy enforcement and reporting, making it essential for the classification requirement.

Shared drives are treated as separate entities and are not automatically covered by a Data Region policy applied to an organizational unit. If Finance users are creating files in a shared drive, those files will not be stored in the specified region unless the shared drive itself is explicitly included in the policy. This is the most likely cause.

Google Vault provides eDiscovery for legal requests, letting administrators search Gmail, Drive, and Chat data by user, date, or term, then export results for litigation holds. It satisfies the stem's requirement to search and export user data specifically for legal requests, unlike standard Workspace admin tools that lack retention and export controls.

Drive sharing options govern external sharing permissions for Google Drive content, letting administrators restrict files from being shared beyond the organisation's domain. This directly satisfies the requirement to prevent sensitive files leaving the organisation, since the setting controls whether users can grant access to external recipients.

The security investigation tool allows you to search Drive audit logs by document ID and filter events such as view, and specify a date range. This provides a report of users who accessed the document, meeting the auditor's request. It is the appropriate tool for this level of detail.

Suspending the account immediately blocks all sign-in attempts, satisfying the requirement to revoke access without deleting the identity. Unlike deletion, suspension preserves the mailbox, OneDrive files and audit history for legal hold or handover, while Microsoft Entra ID tokens are invalidated on next refresh.

Data Region policies in Google Workspace apply to data at rest based on the user's assigned data region, not their physical location. Once a user is assigned to the EU data region, their existing and newly created Drive files are stored in the EU even when they access Drive from the US. No action is needed to maintain the region.

A Vault retention rule applies directly to Chat messages, satisfying the five-year retention requirement. Unlike Google Takeout exports or user-driven holds, Vault retention governs messages in place, preventing deletion until the specified period expires regardless of user action.

The Drive audit log in the Admin Console records events such as sharing changes and downloads, including the actor and target file. Filtering by user and event type provides a chronological record of external sharing and download activity, which is direct evidence for the investigation.

Google Vault is the tool for legal holds. Creating a matter and placing holds on the user's Gmail and Drive ensures their data is preserved indefinitely until the hold is removed. This is the standard procedure for legal holds.

The security centre investigation tool surfaces per-file Drive audit events, including the specific user, timestamp, file ID and download action, satisfying the need for granular download-level detail. Unlike aggregated usage reports or alert-only dashboards, it exposes individual access records, letting you trace exactly which sensitive files the user downloaded.

Vault matter search satisfies the retrospective investigation requirement by querying indexed Gmail messages and Drive files across the employee's entire mailbox and drive history, including deleted items still within retention. Unlike eDiscovery holds or audit logs, it searches content directly, letting you locate specific terms without altering the user's data.

Data regions are applied at the organizational unit level. By placing German users in a dedicated OU and assigning the EU data region, you ensure their covered data is stored in the EU. This is the primary method to enforce data residency.

The data region setting lives under Account > Account settings > Data regions, showing which geographic region stores your organisation's covered data. Navigating there is how an administrator verifies the current data region, matching the question's location requirement.

A Gmail DLP rule can detect predefined or custom patterns such as patient identifiers in message bodies. Setting the action to quarantine holds the message for review by an admin or designated reviewer, which matches the requirement without building complex routing logic.

Suspending the account blocks sign-in immediately while retaining the mailbox, Drive files and other data, and it can be reversed. This matches the stem's constraint of stopping access without deleting data, unlike deletion or archiving.

The Security dashboard aggregates security alerts and highlights suspicious sign-in activity, surfacing potentially compromised accounts through anomaly detection. It satisfies the stem's requirement to identify compromised accounts by correlating risk signals such as unusual login locations and failed authentication patterns, presenting them for administrator review within the Admin Console.

Data region policies apply through OU membership mapped to a region. If the user's OU lacks that mapping, the account defaults to the global region, explaining why data still appears there despite the policy existing.

Similar to Gmail, Vault retention rules for Drive prevent users from permanently deleting files by retaining them in Vault. This ensures that files are preserved for the required period, satisfying the compliance need to prevent data loss.

Disabling download, print and copy for viewers stops recipients exfiltrating file content, even when they legitimately retain view access. This satisfies the data-leakage prevention requirement by restricting what viewers can do with shared files rather than who may open them.

Suspending the account prevents sign-in while keeping the data intact, and placing a Vault hold on the user ensures the data is retained and searchable by the legal team. This combination satisfies both the access restriction and the legal preservation requirement.

DLP for Drive includes predefined detectors for credit card numbers and other sensitive data types. You can create a rule that scans files, triggers on matches, and sends an alert to the file owner. This meets the requirement for automatic detection with minimal administrative effort, as no custom classifiers or manual labeling are needed.

Data classification labels in Google Workspace allow you to apply granular sharing restrictions based on sensitivity. Setting a 'Confidential' label and configuring 'No external sharing' ensures that files with that label cannot be shared outside the organization, even via public links. This precisely meets the compliance requirement for patient data.

A Vault hold preserves the user's data indefinitely, satisfying the seven-year retention requirement without relying on the account itself. Unlike litigation hold on a mailbox, a Vault hold applies across Gmail, Drive and Meet recordings, and survives licence removal, so data remains accessible after the account is deleted.

Context-aware access evaluates access levels built from IP subnet conditions, so only sessions originating from the corporate office range reach the Admin Console. This satisfies the requirement to restrict administrative access by source IP address.

Data Region policies apply to data created after the policy is set; existing data is not automatically migrated. If the employee's files were created before the EU policy was applied, or if the policy does not cover the organizational unit they belong to, their data can still reside in the US region.

The security centre dashboard aggregates alerts from DLP rules, anomaly detection and device trust policies into one view, directly satisfying the stem's requirement for a summary of security incidents and potential policy violations. Unlike audit logs, which list raw events, it surfaces prioritised incidents and policy breaches for administrator triage.

Vault retention rules allow you to set a custom retention period and specify that messages are permanently deleted when the period expires. This enforces the seven-year retention and automatic deletion without user involvement, meeting the regulatory requirement precisely.

App access control lets admins restrict which third-party OAuth apps can access Drive data, directly satisfying the requirement to monitor potentially malicious apps. Unlike trust rules or allowlisting, it evaluates each app's requested scopes and can block risky access, giving the visibility and control needed over third-party Drive access.