Google Professional Cloud Security Engineer Question 355
Select 3Google Cloud PlatformYour organization processes highly sensitive financial data and requires a solution to ensure that data remains encrypted not only at rest and in transit but also during processing. You decide to enable Confidential Computing on Google Cloud. Which of the following steps are necessary to implement Confidential Computing for your workload?
- A
Use Confidential VMs for the workloads requiring in-use encryption.
- B
Enable the Shielded VM feature for all virtual machines in the project.
- C
Ensure that the application code running on Confidential VMs is compatible with Trusted Execution Environment (TEE) requirements.
- D
Deploy the workload on Google Kubernetes Engine (GKE) without any specific configurations, as GKE supports Confidential Computing by default.
- E
Verify that the Confidential VM service account has the appropriate IAM roles to access encrypted data.
Show answer and explanation
Correct answers: A, C, E
Explanation
Confidential Computing on Google Cloud allows workloads to process sensitive data while ensuring encryption during processing. To implement Confidential Computing, you must leverage Confidential VMs, ensure application compatibility with Trusted Execution Environments, and correctly assign IAM roles to service accounts. Shielded VMs and GKE default configurations are unrelated or insufficient for enabling Confidential Computing.
- A. Correct.
Correct: Confidential VMs are a core part of Google Cloud's Confidential Computing solution, providing in-use encryption by leveraging hardware-based Trusted Execution Environments (TEEs).
- B. Incorrect.
Incorrect: Shielded VMs enhance security by protecting against rootkits and boot-level attacks, but they are not related to Confidential Computing or in-use encryption.
- C. Correct.
Correct: Confidential Computing relies on Trusted Execution Environments (TEEs), so applications must be compatible with TEE requirements to leverage the security features effectively.
- D. Incorrect.
Incorrect: While GKE is a managed Kubernetes service, it does not support Confidential Computing by default. Specific configurations, like using Confidential VMs for GKE nodes, are required to enable Confidential Computing.
- E. Correct.
Correct: To access encrypted data securely, the Confidential VM must have the appropriate IAM roles assigned to its service account to avoid any unauthorized access.