nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #294

Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the…

The correct answer is A. Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the. To detect healthcare data in Cloud Storage buckets outside of the EU, create a Sensitive Data Protection job configured to inspect buckets in non-EU regions for specific healthcare infoTypes.

Submitted by kwame.gh· Apr 18, 2026Ensuring data protection

Question

Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance requirement, you want to detect if Cloud Storage buckets outside of the EU contain healthcare data. What should you do?

Options

  • ACreate a Sensitive Data Protection job. Specify the infoType of data to be detected and run the
  • BCreate a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log
  • CActivate Security Command Center Premium. Use compliance monitoring to detect resources that
  • DEnforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only

How the community answered

(46 responses)
  • A
    80% (37)
  • B
    2% (1)
  • C
    7% (3)
  • D
    11% (5)

Why each option

To detect healthcare data in Cloud Storage buckets outside of the EU, create a Sensitive Data Protection job configured to inspect buckets in non-EU regions for specific healthcare infoTypes.

ACreate a Sensitive Data Protection job. Specify the infoType of data to be detected and run theCorrect

Google Cloud Sensitive Data Protection (DLP) is explicitly designed to discover and classify sensitive data, including various healthcare-related infoTypes, by scanning data in Cloud Storage. Running a job against non-EU buckets directly addresses the requirement to detect healthcare data outside of the EU.

BCreate a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log

A log sink can track resource creation or access locations but cannot inspect the actual content within Cloud Storage buckets for specific types of data like healthcare information.

CActivate Security Command Center Premium. Use compliance monitoring to detect resources that

Security Command Center's compliance monitoring primarily checks resource configurations against policies and does not inspect the content of storage buckets for specific sensitive data types.

DEnforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only

The gcp.resourceLocations organization policy prevents the creation of new resources outside specified regions, but it does not detect existing sensitive data within already deployed resources.

Concept tested: Sensitive data discovery and classification

Source: https://cloud.google.com/sensitive-data-protection/docs/inspecting-storage

Topics

#Sensitive Data Protection#Data Loss Prevention (DLP)#Data Residency#Compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice