Google Professional Cloud Security Engineer Question 353
Select 3Google Cloud PlatformYour organization processes sensitive customer data in Google Cloud and is required to ensure that data remains encrypted during processing. You are tasked with implementing a solution that leverages Confidential Computing to meet this requirement. What steps should you take to enable Confidential Computing for your workloads in Google Cloud?
- A
Use Confidential VM instances for your workloads.
- B
Enable Shielded VM instances for secure boot and integrity monitoring.
- C
Ensure your application is compatible with trusted execution environments (TEEs).
- D
Encrypt data using Cloud KMS before storing it in Confidential VM memory.
- E
Use Google Cloud's Confidential GKE Nodes for containerized workloads.
Show answer and explanation
Correct answers: A, C, E
Explanation
Confidential Computing in Google Cloud ensures that data is encrypted during processing by using Confidential VMs or Confidential GKE Nodes. These solutions leverage trusted execution environments (TEEs) to provide hardware-based encryption for workloads. Shielded VMs, while offering security features, are unrelated to Confidential Computing, and manual encryption of memory using Cloud KMS is unnecessary as the encryption is handled automatically by the Confidential Computing infrastructure.
- A. Correct.
Correct. Confidential VM instances are required to enable Confidential Computing in Google Cloud. They ensure data is encrypted during processing.
- B. Incorrect.
Incorrect. Shielded VM instances provide protection against rootkits and boot-level attacks but are not part of the Confidential Computing solution.
- C. Correct.
Correct. Applications running on Confidential VM instances must be compatible with trusted execution environments (TEEs) to leverage the encryption during processing.
- D. Incorrect.
Incorrect. Data in Confidential VM memory is automatically encrypted; there is no need to manually encrypt it using Cloud KMS.
- E. Correct.
Correct. Confidential GKE Nodes provide the same Confidential Computing capabilities for containerized workloads, ensuring encryption during processing.