Google Professional Cloud Security Engineer Question 317
Select 3Google Cloud PlatformYour organization processes sensitive customer data using Google Cloud services, and you need to ensure that data is encrypted at rest, in transit, and in use to maintain compliance with regulatory requirements. Which of the following steps should you take to achieve this goal?
- A
Enable Customer-Managed Encryption Keys (CMEK) for applicable Google Cloud services to control encryption at rest.
- B
Use Cloud Data Loss Prevention (DLP) to monitor data access and prevent unauthorized use.
- C
Enable and enforce TLS/SSL for all communications between services and clients to ensure encryption in transit.
- D
Leverage Confidential Computing to encrypt data while it is being processed in memory.
- E
Disable Google-managed encryption to fully rely on custom encryption methods.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage encryption at rest, in transit, and in use, you need to implement measures that address each stage of data security. CMEK grants control over encryption at rest, TLS/SSL ensures encryption in transit, and Confidential Computing protects data in use. Cloud DLP, while valuable for data protection, does not provide encryption capabilities, and disabling Google-managed encryption could compromise security.
- A. Correct.
Customer-Managed Encryption Keys (CMEK) allow you to control encryption at rest by using your own keys, ensuring that data is encrypted with keys you manage. This is an essential step for encryption at rest.
- B. Incorrect.
Cloud Data Loss Prevention (DLP) is a useful tool for detecting and protecting sensitive data but does not directly handle encryption at rest, in transit, or in use.
- C. Correct.
TLS/SSL ensures that data is encrypted during transmission, which is critical for meeting encryption in transit requirements.
- D. Correct.
Confidential Computing protects data while it is being processed in memory by encrypting it in use, addressing the encryption in use requirement.
- E. Incorrect.
Disabling Google-managed encryption is not recommended, as Google-managed encryption ensures baseline security and compliance. Instead, you can augment this with CMEK or CSEK for additional control.