Google Professional Cloud Security Engineer Question 318
Select 4Google Cloud PlatformYour organization uses Google Cloud to host sensitive customer data and must comply with strict regulatory requirements for data encryption. You are tasked with ensuring that data is encrypted at rest, in transit, and in use. Which of the following steps should you take to meet these requirements?
- A
Enable Customer-Managed Encryption Keys (CMEK) for storage buckets and other supported services.
- B
Use TLS 1.3 for securing data in transit between clients and Cloud services.
- C
Configure Confidential VMs to encrypt data while it is being processed in memory.
- D
Disable default encryption at rest provided by Google Cloud to implement custom encryption algorithms.
- E
Set up IPsec tunnels for secure communication between on-premises systems and Google Cloud.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Encrypting data at rest, in transit, and in use requires configuring appropriate tools and technologies in Google Cloud. CMEK adds control for encryption at rest, TLS 1.3 secures data in transit, and Confidential VMs ensure encryption in use. IPsec tunnels further secure communication between systems. Disabling default encryption is counterproductive and not aligned with best practices for security.
- A. Correct.
Enabling Customer-Managed Encryption Keys (CMEK) ensures that data at rest is encrypted using keys you manage, providing additional control and compliance with regulatory requirements.
- B. Correct.
TLS 1.3 provides encryption for data in transit, ensuring secure communication between clients and Google Cloud services.
- C. Correct.
Confidential VMs encrypt data while it is being processed in memory, addressing the encryption-in-use requirement.
- D. Incorrect.
Disabling Google's default encryption at rest is not recommended and would violate best practices, as it could lead to non-compliance and security vulnerabilities.
- E. Correct.
Setting up IPsec tunnels ensures secure, encrypted communication between on-premises systems and Google Cloud resources, contributing to encryption in transit.