Google Exam Professional-Cloud-Security-Engineer Topic 3 Question 68 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 68
Topic #: 3

[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

ACreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

BMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

CConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

DCreate Confidential VMs to access the sensitive data.

EConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

Show Suggested Answer

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

by Kirk at Nov 27, 2023, 09:02 AM

Limited Time Offer

25%

Off

Get Premium Professional-Cloud-Security-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leonora

10 days ago

Yeah, the Confidential VMs seem like a good option, but I'm not sure they'll be enough on their own. We might need to look at the External Key Manager or Customer Managed Encryption Keys as well.

upvoted 0 times

...

Nu

11 days ago

Hmm, options B and D both mention Confidential VMs. I wonder if that's the way to go, since it sounds like it could help with the encryption requirements.

upvoted 0 times

...

Son

12 days ago

I agree, this is a tough one. We need to make sure we encrypt the data at all stages, while also maintaining control of the encryption keys.

upvoted 0 times

...

Erick

13 days ago

This is a tricky question. We need to find a solution that meets all the compliance requirements, but also doesn't overly complicate the architecture.

upvoted 0 times

...