Google Exam Professional Cloud Security Engineer Topic 4 Question 85 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 85
Topic #: 4

[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

ACreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

BMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

CConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

DCreate Confidential VMs to access the sensitive data.

EConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

Show Suggested Answer

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

by Delila at Aug 07, 2024, 02:39 PM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Remona

2 months ago

Ha, this is like a 'spot the difference' puzzle, but for cloud security! C and E are definitely the answers that will keep the compliance team happy.

upvoted 0 times

...

2 months ago

The question is asking for 2 answers, so I'd go with C and E. Confidential VMs might be overkill for this use case.

upvoted 0 times

Glen

2 months ago

Yeah, managing the encryption keys outside of Google Cloud and using Customer Managed Encryption Keys seems like the way to go.

upvoted 0 times

...

Hermila

2 months ago

Confidential VMs might be too much for this workload, sticking with C and E is a safer bet.

upvoted 0 times

...

Oren

2 months ago

I agree, C and E seem like the best options to meet the data protection requirements.

upvoted 0 times

...

3 months ago

Hmm, I think the answer is C and E. Maintaining full control of encryption keys is key here, and the Cloud External Key Manager and Customer Managed Encryption Keys options seem to cover that requirement.

upvoted 0 times