Google Professional Cloud Security Engineer Question 344
Select 3Google Cloud PlatformYou are managing a healthcare application that processes sensitive patient data. To meet regulatory compliance such as HIPAA, you need to ensure that the data is encrypted both at rest and in transit. Which combination of encryption methods would be most appropriate to secure the data while also leveraging Google Cloud services effectively?
- A
Use Google-managed encryption keys for Cloud Storage and enable HTTPS for data transfer.
- B
Enable customer-managed encryption keys (CMEK) for Cloud Storage and use Cloud VPN for secure communication.
- C
Encrypt data using client-side encryption before uploading to Cloud Storage and use IAM roles to control access.
- D
Use server-side encryption with default Google-managed keys for Cloud Storage and use a public HTTP endpoint for data transfer.
- E
Use Cloud KMS with customer-supplied encryption keys (CSEK) for Cloud Storage and configure SSL/TLS for data in transit.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure sensitive patient data in compliance with regulations like HIPAA, you must encrypt data both at rest and in transit. Google Cloud offers several encryption options, including Google-managed keys, customer-managed keys (CMEK), and customer-supplied keys (CSEK) for encryption at rest. For data in transit, HTTPS, SSL/TLS, or a secure communication channel (e.g., Cloud VPN) ensures data remains encrypted during transmission. The selected options provide a balance of security and compliance while leveraging Google Cloud's encryption capabilities effectively.
- A. Correct.
This is correct because Google-managed encryption keys simplify encryption management for data at rest, and enabling HTTPS ensures encryption for data in transit.
- B. Correct.
This is correct because customer-managed encryption keys (CMEK) provide greater control over key management, and Cloud VPN ensures secure communication for data in transit.
- C. Incorrect.
This is incorrect because while client-side encryption adds security, it is not required for compliance when using Google Cloud's built-in encryption features. Additionally, IAM roles control access but do not encrypt data in transit.
- D. Incorrect.
This is incorrect because using a public HTTP endpoint does not encrypt data in transit, which fails to meet compliance requirements.
- E. Correct.
This is correct because Cloud KMS with customer-supplied encryption keys (CSEK) provides compliance with strict encryption requirements, and SSL/TLS ensures encryption for data in transit.