A public-health GPU hall must sync de-identified training features nightly without exposing raw 911 audio. Which hybrid data-synchronization approach is appropriate?

A public-health GPU hall that must sync de-identified training features nightly without exposing raw 911 audio should synchronize only approved de-identified feature sets under privacy controls, not raw 911 audio. Hybrid data movement is appropriate when the payload matches residency and privacy rules: derived features that were cleared for egress, with sensitive recordings retained on-premises.

Synchronizing approved de-identified feature sets via nightly volume snapshots under privacy controls uses the wrong granularity, because block-level volume snapshots copy entire volumes and cannot restrict egress to only allow-listed feature schemas, risking raw 911 audio exposure and violating the privacy boundary the stem requires. Synchronizing approved de-identified feature sets under privacy controls using bidirectional sync replaces controlled one-way outbound sync with uncontrolled two-way flow, letting cloud-side changes write back into the curated source and creating governance and integrity risk. Publishing approved de-identified feature sets under privacy controls via shared writable training prefix lets training jobs alter or delete the synchronized payload, which is a governance failure, not a controlled read-only publish for consumption.

Exam caveat: Domain 2.5 expects hybrid data synchronization to respect privacy and residency; de-identification and allow-lists are part of the architecture, not optional paperwork after the first sync job succeeds.

Operational check: inventory what the nightly job ships, confirm only approved feature schemas leave the public-health boundary, and sample-audit that raw 911 audio paths are absent from cloud destinations.