Google Professional Cloud Security Engineer Question 319
Select 3Google Cloud PlatformYour company uses Google Cloud to host sensitive customer data, including personal identifiable information (PII). To comply with regulatory requirements, you need to ensure that the data is encrypted at rest, in transit, and in use. Which of the following steps should you take to meet these requirements?
- A
Enable Customer-Managed Encryption Keys (CMEK) for storage resources such as Cloud Storage buckets and Persistent Disks.
- B
Use Google Cloud's default encryption for all storage and ensure it is sufficient to meet compliance.
- C
Enforce the use of TLS 1.2 or higher for all in-transit communications involving PII.
- D
Use Confidential Computing to protect data while it is being processed in memory.
- E
Disable encryption of data at rest to reduce latency during access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet regulatory requirements and secure sensitive PII, it is essential to encrypt data at rest, in transit, and in use. Enabling CMEK ensures control over encryption keys for data at rest. Enforcing TLS 1.2 or higher secures data in transit, while Confidential Computing protects data in use. Simply relying on default encryption may not be sufficient for compliance, and disabling encryption is never a valid approach.
- A. Correct.
Enabling Customer-Managed Encryption Keys (CMEK) provides additional control over encryption keys, which can be required for regulatory compliance. This meets the requirement for encryption at rest.
- B. Incorrect.
While Google Cloud's default encryption is strong, regulatory requirements may necessitate additional measures like CMEK or Customer-Supplied Encryption Keys (CSEK). Default encryption alone might not always satisfy compliance needs.
- C. Correct.
TLS 1.2 or higher is essential for encrypting data in transit and ensuring secure communication channels. This meets the requirement for encryption in transit.
- D. Correct.
Confidential Computing uses hardware-based Trusted Execution Environments (TEEs) to encrypt data while in use, meeting the requirement for encryption in use.
- E. Incorrect.
Disabling encryption of data at rest is against best practices and would violate compliance requirements. This option is incorrect.