Google Professional Data Engineer Question 81
Select 2Google Cloud PlatformYou are designing a data processing pipeline on Google Cloud to handle sensitive customer data. The data must remain encrypted both at rest and in transit. Which combination of tools or features should you use to ensure proper encryption in this scenario?
- A
Use Cloud Storage with server-side encryption and configure a Customer-Managed Encryption Key (CMEK) in Cloud Key Management Service (KMS).
- B
Enable Cloud Storage Transfer Service to encrypt data in transit using TLS.
- C
Use Cloud Dataflow with default Google-managed encryption keys for data processing.
- D
Use Cloud Storage with server-side encryption and rely on Google-managed encryption keys (GMEK).
- E
Use a VPN tunnel to encrypt data at rest within your Virtual Private Cloud (VPC).
Show answer and explanation
Correct answers: A, B
Explanation
To ensure sensitive customer data remains encrypted both at rest and in transit, you must use appropriate encryption mechanisms tailored to each stage. Using Cloud Storage with server-side encryption and CMEK gives you control over encryption keys for data at rest, while enabling TLS for Cloud Storage Transfer Service ensures encryption in transit. Default Google-managed keys or VPNs alone are not sufficient to meet the requirements for both at-rest and in-transit encryption of sensitive data.
- A. Correct.
This is correct because using Cloud Storage with CMEK ensures that you have full control over the encryption keys used for data at rest.
- B. Correct.
This is correct because enabling TLS for data transfer through Cloud Storage Transfer Service ensures encryption in transit.
- C. Incorrect.
This is incorrect because while Google-managed keys offer encryption, they do not give you full control over the keys, which may not meet compliance requirements for sensitive data.
- D. Incorrect.
This is incorrect because relying solely on Google-managed encryption keys (GMEK) may not meet your security or compliance requirements for sensitive customer data.
- E. Incorrect.
This is incorrect because VPN tunnels are used to encrypt network traffic but do not encrypt data at rest within Cloud Storage or other storage services.