Google Professional Data Engineer Question 80
Select 3Google Cloud PlatformYou are designing a data pipeline on Google Cloud for a healthcare organization that must comply with HIPAA regulations. The data contains sensitive patient information. Which encryption approaches should you implement to ensure compliance and secure data both in transit and at rest?
- A
Use Cloud Storage with Customer-Managed Encryption Keys (CMEK) for data at rest.
- B
Enable TLS (Transport Layer Security) for all data transmissions.
- C
Use Cloud Storage with Google-managed encryption keys for data at rest without additional encryption layers.
- D
Disable encryption for internal network communication since Google Cloud encrypts data by default.
- E
Implement envelope encryption for sensitive data before uploading it to Google Cloud.
Show answer and explanation
Correct answers: A, B, E
Explanation
HIPAA compliance requires robust encryption measures to protect sensitive patient data both at rest and in transit. Using CMEK for data at rest ensures key management control, enabling TLS encrypts data in transit, and implementing envelope encryption provides an additional layer of security for sensitive information. These measures collectively ensure compliance and align with best practices.
- A. Correct.
Using Cloud Storage with Customer-Managed Encryption Keys (CMEK) ensures that you retain control over encryption keys, which is crucial for meeting compliance requirements like HIPAA.
- B. Correct.
Enabling TLS for all data transmissions secures data in transit and is a key requirement for protecting sensitive information in compliance with regulations.
- C. Incorrect.
While Google-managed encryption keys encrypt data at rest by default, using additional layers like CMEK or envelope encryption provides more control and may be necessary for HIPAA compliance.
- D. Incorrect.
Disabling encryption for internal network communication is not advisable, even though Google Cloud encrypts data by default. Explicitly enabling encryption ensures compliance with security best practices.
- E. Correct.
Envelope encryption adds another layer of security by encrypting data before it is uploaded to the cloud. This approach is often required for sensitive data and aligns with compliance requirements like HIPAA.