Google Professional Cloud Security Engineer Question 321
Select 3Google Cloud PlatformYou are designing a data storage solution for a healthcare application on Google Cloud. The application must adhere to strict compliance requirements for protecting sensitive patient information, ensuring encryption at rest, in transit, and in use. Which of the following approaches meet these requirements?
- A
Use Cloud Storage with a Customer-Managed Encryption Key (CMEK) for encrypting data at rest.
- B
Enable HTTPS with TLS 1.3 for secure communication between clients and the application.
- C
Use Confidential VMs to ensure data is encrypted during processing (in use).
- D
Rely on Google Cloud's default encryption at rest without adding any additional encryption layers.
- E
Disable Secure Socket Layer (SSL) for faster network communication.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet healthcare compliance requirements, it is essential to ensure encryption at all stages: at rest, in transit, and in use. Using CMEK provides enhanced encryption control for data at rest, TLS 1.3 secures data in transit, and Confidential VMs provide encryption during processing (in use). Relying solely on default encryption or disabling SSL does not meet the strict standards required for sensitive applications like healthcare.
- A. Correct.
Using a Customer-Managed Encryption Key (CMEK) ensures additional control and compliance for encrypting data at rest, which is required for sensitive use cases like healthcare.
- B. Correct.
Enabling HTTPS with TLS 1.3 ensures that data is encrypted during transit, meeting compliance and security requirements for communication.
- C. Correct.
Confidential VMs encrypt data while it is being processed (in use), fulfilling the requirement for encryption in use.
- D. Incorrect.
While Google Cloud provides default encryption at rest, relying solely on it may not meet strict compliance requirements that mandate explicit encryption control, such as using CMEK.
- E. Incorrect.
Disabling SSL undermines the security of data in transit and violates compliance requirements, making this option unsuitable.