A regulated insurer requires that every BigQuery dataset in its organization be encrypted with keys its security team controls. The control must block creation of BigQuery datasets that use Google-managed keys in any project. Which mechanism enforces this?
Show answer and explanation
Answer: B
The restrictNonCmekServices organization policy constraint, with BigQuery in its list, prevents supported resources from being created without a customer-managed encryption key. That enforces the requirement across the organization instead of relying on individual project owners. Default Google-managed encryption does not give the customer key control, and labels only record ownership without enforcing encryption.
Why the other options are wrong
- A. Manual switching after creation leaves a window where datasets are unprotected and depends on each owner remembering. It is neither enforced nor organization-wide.
- C. Google-managed default encryption protects data at rest, but the insurer wants its security team to hold the keys. That requires customer-managed keys, which default encryption does not provide.
- D. Labels are metadata for tracking and cost allocation. They do not change how data is encrypted, so a label would not block datasets that use Google-managed keys.