Google Exam Professional Cloud Security Engineer Topic 2 Question 97 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 97
Topic #: 2

[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

ACreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

BMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

CConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

DCreate Confidential VMs to access the sensitive data.

EConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

Show Suggested Answer

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

by Nydia at Jan 23, 2025, 11:17 PM

Limited Time Offer

25%

27 days ago

Gotta love these 'choose 2' questions. I'm going with C and E - that way we get the best of both worlds, and the compliance team can't say we didn't cover all their requirements.

upvoted 0 times

Alyce

9 days ago

That's a smart choice. By using Cloud External Key Manager and Customer Managed Encryption Keys, we can cover all our bases for encrypting and decrypting sensitive data.

upvoted 0 times

...

Eliseo

12 days ago

I agree, C and E seem like the most comprehensive options to ensure we meet all the data protection requirements.

upvoted 0 times

...

Annita

28 days ago

Haha, I'd love to see the look on the compliance team's face if we just went with option D and said 'Confidential VMs, problem solved!'

upvoted 0 times

...

Nichelle

1 months ago

I think a combination of C and E would be the way to go. Using the External Key Manager to manage the keys, and Customer Managed Encryption Keys for the actual encryption and decryption.

upvoted 0 times

...

Lawrence

1 months ago

Option C looks like the best solution here. Encrypting the data before and after upload is exactly what we need to meet the compliance requirements.

upvoted 0 times

Lucille

15 days ago

I agree, using Cloud External Key Manager to encrypt and decrypt the sensitive data seems like the most secure option.

upvoted 0 times

...

Lynsey

19 days ago

Option C looks like the best solution here. Encrypting the data before and after upload is exactly what we need to meet the compliance requirements.

upvoted 0 times

...