Google Exam Professional Cloud Security Engineer Topic 3 Question 79 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 79
Topic #: 3

[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

ACreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

BMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

CConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

DCreate Confidential VMs to access the sensitive data.

EConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

Show Suggested Answer

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

by Cary at May 19, 2024, 01:07 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Van

6 months ago

I'm just gonna go with C and E. No need to overthink this, right? Unless, of course, you're a secret agent working for the CIA. In that case, you're probably already using Confidential VMs. *puts on sunglasses*

upvoted 0 times

...

Jaime

6 months ago

Encrypt all the things! Seriously, C and E are the way to go. Unless, of course, you want to live dangerously and just use Confidential VMs. *wink wink*

upvoted 0 times

Denny

5 months ago

Confidential VMs could be a risky choice, but it's an option to consider.

upvoted 0 times

...

Alishia

5 months ago

Encrypting data is crucial for compliance. C and E are the best options.

upvoted 0 times

...

Elizabeth

6 months ago

Confidential VMs could be a risky choice, but it's an option to consider.

upvoted 0 times

...

Reita

6 months ago

E) Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

upvoted 0 times

...

Jody

6 months ago

C) Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

upvoted 0 times

...