Google Exam Professional-Cloud-Security-Engineer Topic 4 Question 75 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 75
Topic #: 4

[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

ACreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

BMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

CConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

DCreate Confidential VMs to access the sensitive data.

EConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

Show Suggested Answer

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

by Leslie at Apr 13, 2024, 01:09 AM

Limited Time Offer

25%

Off

Get Premium Professional-Cloud-Security-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Adelle

3 months ago

Yes, that way we can encrypt the data before uploading it to Cloud Storage and then decrypt it when needed.

upvoted 0 times

...

Maryrose

3 months ago

I think configuring Customer Managed Encryption Keys could be a good option for us.

upvoted 0 times

...

Yuriko

4 months ago

We could also consider encrypting the sensitive data in memory while in use in the Compute Engine VMs.

upvoted 0 times

...

Adelle

4 months ago

I believe we should also encrypt sensitive data before uploading it to Cloud Storage.

upvoted 0 times

...

Maryrose

4 months ago

I agree, we should manage the data encryption key outside the Google Cloud boundary.

upvoted 0 times

...

Adelle

4 months ago

I think we need to make sure we meet the data protection requirements for sensitive data.

upvoted 0 times

...

Kayleigh

4 months ago

User 2: Yes, that's one of the requirements. We need to ensure data is encrypted at all times.

upvoted 0 times

...

Tyra

4 months ago

User 1: So, should we also decrypt the sensitive data during processing in the Compute Engine VMs?

upvoted 0 times

...

Gertude

4 months ago

User 4: I believe we should encrypt the sensitive data before uploading it to Cloud Storage.

upvoted 0 times

...

Vincent

5 months ago

User 3: Yes, we definitely need to manage the encryption keys properly to ensure data security.

upvoted 0 times

...

Maryann

5 months ago

User 2: I think we need to focus on meeting the data protection requirements for sensitive data.

upvoted 0 times

...

Fernanda

5 months ago

User 1: I'm not sure what to do with this question, it seems quite complex.

upvoted 0 times

...

Kanisha

6 months ago

But seriously, we can't rely on just Confidential VMs. We need to have that extra layer of encryption with the external key management. Option C and E seem like the way to go.

upvoted 0 times

...

Nydia

6 months ago

Yeah, that could be a good solution. Although, I'm not sure if the compliance team would be happy with the Google-managed encryption keys, even in Confidential VMs.

upvoted 0 times

...

Justa

6 months ago

Haha, can you imagine the look on the compliance team's face if we just put all the sensitive data in Confidential VMs? 'Yeah, we totally encrypted it, just don't look too closely!'

upvoted 0 times

...

Vallie

6 months ago

I think option C and E are the most relevant answers here. We need to use external key management to encrypt the data before it's uploaded to Cloud Storage, and then decrypt it in the VMs.

upvoted 0 times

...

Shanice

6 months ago

Ooh, Confidential VMs, that's an interesting idea! I heard those can help with the data encryption and security, while still keeping the performance high.

upvoted 0 times

...

Raelene

6 months ago

This compliance requirement is a tricky one. We need to find a way to manage the encryption keys outside of Google Cloud and maintain full control over them.

upvoted 0 times

Rossana

5 months ago

E) Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

upvoted 0 times

...

Galen

5 months ago

C) Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs.

upvoted 0 times

...

Ashlyn

6 months ago

Good point. We'll have to weigh the performance impact against the compliance requirements. Maybe we can find a way to minimize the decryption overhead, like using Confidential VMs or something.

upvoted 0 times

...

Royal

6 months ago

I agree, the third-party key management is key here. But what about the performance impact? Decrypting the data during processing in the VMs could slow things down, don't you think?

upvoted 0 times

Whitney

5 months ago

E) Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs provides control over the encryption keys and data protection.

upvoted 0 times

...

Mila

5 months ago

True, but balancing security with performance is crucial for handling sensitive data.

upvoted 0 times

...

Michel

5 months ago

upvoted 0 times

...

Isidra

6 months ago

A) Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets could help in securing the data.

upvoted 0 times

...

Isaac

6 months ago

I agree, there might be a performance impact with decrypting the data during processing in the VMs.

upvoted 0 times

...

Jade

6 months ago

E) Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

upvoted 0 times

...

Cherelle

6 months ago

A) Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

upvoted 0 times

...

Shawna

6 months ago

Yeah, definitely. And having full control of the encryption keys through a third-party provider is also crucial. I'm not sure if the Google-managed keys would be enough to satisfy the compliance team.

upvoted 0 times

...

Lashunda

6 months ago

Hmm, this is a tricky one. We really need to make sure we're meeting all the compliance requirements here. Encrypting the data before it even leaves the endpoint computers sounds like a must-have.

upvoted 0 times

...