Google Professional Cloud Security Engineer Question 322
Select 3Google Cloud PlatformYou are designing a secure application on Google Cloud that processes sensitive customer data. The application must ensure data encryption at rest, in transit, and in use. Which of the following methods would best meet these requirements?
- A
Use Cloud Storage with Customer-Managed Encryption Keys (CMEK) for data at rest.
- B
Enable TLS 1.3 for all communication between client applications and backend services.
- C
Utilize Confidential VMs to ensure data is encrypted while being processed.
- D
Rely on Google Cloud's default encryption for data at rest without additional configuration.
- E
Compress data instead of encrypting it in transit to optimize bandwidth usage.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirement for encryption at rest, in transit, and in use, it is essential to configure specific tools and features. Using CMEK ensures control over encryption at rest, TLS 1.3 secures data in transit, and Confidential VMs address the challenge of encryption in use. These methods together comprehensively secure sensitive customer data across all stages.
- A. Correct.
This is correct. Using CMEK for Cloud Storage gives you control over encryption keys, ensuring strong encryption for data at rest.
- B. Correct.
This is correct. Enabling TLS 1.3 protects data in transit by encrypting communication between client and server.
- C. Correct.
This is correct. Confidential VMs encrypt data while it is being processed, addressing the 'encryption in use' requirement.
- D. Incorrect.
While Google Cloud's default encryption does encrypt data at rest, it does not provide the same level of control and security customization as CMEK.
- E. Incorrect.
This is incorrect. Compressing data does not fulfill encryption requirements and does not guarantee data protection during transmission.