GCP Professional Data Engineer Practice Question

Assured Workloads with the EU Regions and Support compliance regime automatically applies organization-policy constraints that keep resources and data in EU locations and limit Google support access to personnel physically located in the EU. Storing BigQuery datasets in an EU location satisfies residency mandates, while enabling CMEK with keys in a Cloud KMS keyring you manage provides demonstrable control of encryption keys for auditors with minimal additional operational burden. Exporting Cloud Audit Logs to a centralized project preserves immutable evidence of key use and administrative access. The other options fail to meet one or more compliance requirements: using the US multi-region violates data-residency, CSEK adds operational overhead and cannot be centrally managed in Cloud KMS, and default Google-managed encryption does not give auditors proof of customer control. A dedicated single-tenant region is not an available offering and default encryption alone is insufficient for the stated compliance needs.