GCP Professional Data Engineer Practice Question

FinBank, a Finnish financial institution, plans to archive 100 TB of customer statements on Google Cloud. Regulators require that the data must physically remain in Finland and that encryption keys stay under Finnish jurisdiction so that no foreign entity, including Google, can access them. The operations team evaluates four designs. Which approach best satisfies both the data residency and data sovereignty requirements while keeping day-to-day operational effort low?

Keep the archive on an on-premises NFS server mounted to a Compute Engine VM in Finland and replicate snapshots to a multi-regional EU Cloud Storage bucket encrypted with Google-managed keys.
Use a regional Cloud Storage bucket in europe-north1, encrypt it with keys held in a Finnish on-premises HSM through Cloud External Key Manager, and enable Assured Workloads for the EU environment.
Store the files in a dual-region Cloud Storage bucket spanning europe-north1 and europe-west1, protected by Google-managed encryption keys.
Create a regional Cloud Storage bucket in europe-north1 and secure it with a Customer-Managed Encryption Key (CMEK) stored in Cloud KMS in the same region.

Report Issue

Answer Description

Data residency is met when the data itself is stored in a specific geography, so a regional Cloud Storage bucket in europe-north1 (Finland) is necessary. Data sovereignty additionally demands that control of the encryption keys never leave Finnish jurisdiction; relying on Google-managed or even Google-hosted CMEK keys does not meet this constraint because Google can be compelled to provide access. Customer-supplied encryption keys (CSEK) avoid that risk but require operators to pass the key with every request, creating high operational overhead. By contrast, Cloud External Key Manager (EKM) keeps the keys in a customer-controlled HSM located in Finland and provides an online key-handling interface that avoids per-request manual key delivery. Combining a regional bucket in europe-north1 with EKM and Assured Workloads (which restricts Google personnel access to the EU, including Finland) satisfies both the physical-location and legal-control requirements with minimal ongoing effort. The other options either store data outside Finland, leave key custody with Google, or impose significant manual key-handling overhead, so they fail to meet one or both regulatory conditions.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.