Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Exam Professional-Cloud-Security-Engineer Topic 4 Question 75 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam
Question #: 75
Topic #: 4
[All Professional Cloud Security Engineer Questions]

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat

a. You need to meet these requirements;

* Manage the data encryption key (DEK) outside the Google Cloud boundary.

* Maintain full control of encryption keys through a third-party provider.

* Encrypt the sensitive data before uploading it to Cloud Storage

* Decrypt the sensitive data during processing in the Compute Engine VMs

* Encrypt the sensitive data in memory while in use in the Compute Engine VMs

What should you do?

Choose 2 answers

Show Suggested Answer Hide Answer
Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance


by Leslie at Apr 13, 2024, 01:09 AM

Limited Time Offer

25%

Off

Get Premium Professional-Cloud-Security-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Kanisha
8 days ago
But seriously, we can't rely on just Confidential VMs. We need to have that extra layer of encryption with the external key management. Option C and E seem like the way to go.
upvoted 0 times
...
Nydia
8 days ago
Yeah, that could be a good solution. Although, I'm not sure if the compliance team would be happy with the Google-managed encryption keys, even in Confidential VMs.
upvoted 0 times
...
Justa
9 days ago
Haha, can you imagine the look on the compliance team's face if we just put all the sensitive data in Confidential VMs? 'Yeah, we totally encrypted it, just don't look too closely!'
upvoted 0 times
...
Vallie
10 days ago
I think option C and E are the most relevant answers here. We need to use external key management to encrypt the data before it's uploaded to Cloud Storage, and then decrypt it in the VMs.
upvoted 0 times
...
Shanice
10 days ago
Ooh, Confidential VMs, that's an interesting idea! I heard those can help with the data encryption and security, while still keeping the performance high.
upvoted 0 times
...
Raelene
11 days ago
This compliance requirement is a tricky one. We need to find a way to manage the encryption keys outside of Google Cloud and maintain full control over them.
upvoted 0 times
...
Ashlyn
11 days ago
Good point. We'll have to weigh the performance impact against the compliance requirements. Maybe we can find a way to minimize the decryption overhead, like using Confidential VMs or something.
upvoted 0 times
...
Royal
12 days ago
I agree, the third-party key management is key here. But what about the performance impact? Decrypting the data during processing in the VMs could slow things down, don't you think?
upvoted 0 times
...
Shawna
14 days ago
Yeah, definitely. And having full control of the encryption keys through a third-party provider is also crucial. I'm not sure if the Google-managed keys would be enough to satisfy the compliance team.
upvoted 0 times
...
Lashunda
16 days ago
Hmm, this is a tricky one. We really need to make sure we're meeting all the compliance requirements here. Encrypting the data before it even leaves the endpoint computers sounds like a must-have.
upvoted 0 times
...

Save Cancel