Your organization wants to be General Data Protection Regulation (GDPR) compliant. You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions. What should…

Question

Options

• AUse Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google
• BUse the org policy constraint 'Google Cloud Platform - Resource Location Restriction' on your
• CUse the org policy constraint 'Restrict Resource Service Usage' on your Google Cloud
• DUse Identity and Access Management (IAM) custom roles to ensure that your DevOps team can

• A
  11% (3)
• B
  81% (22)
• C
  4% (1)
• D
  4% (1)

Explanation

The 'Resource Location Restriction' organization policy constraint (constraints/gcp.resourceLocations) allows administrators to restrict where Google Cloud resources can be created to specific regions or multi-regions. Applying this at the organization level and allowing only Europe regions ensures DevOps teams cannot provision resources outside those locations, which directly supports GDPR data residency requirements. Option A (IAP with Access Context Manager) controls who can access resources, not where resources are created. Option C ('Restrict Resource Service Usage') limits which Google Cloud services can be used, not the geographic location of resources. Option D (IAM custom roles) can restrict actions, but IAM does not natively enforce geographic restrictions on resource creation.

No community discussion yet for this question.