Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Professional Data Engineer Exam - Topic 1 Question 7 Discussion

You want to archive data in Cloud Storage. Because some data is very sensitive, you want to use the ''Trust No One'' (TNO) approach to encrypt your data to prevent the cloud provider staff from decrypting your data. What should you do?
B) Use gcloud kms keys create to create a symmetric key. Then use gcloud kms encrypt to encrypt each archival file with the key. Use gsutil cp to upload each encrypted file to the Cloud Storage bucket. Manually destroy the key previously used for encryption, and rotate the key once and rotate the key once.
A) Use gcloud kms keys create to create a symmetric key. Then use gcloud kms encrypt to encrypt each archival file with the key and unique additional authenticated data (AAD). Use gsutil cp to upload each encrypted file to the Cloud Storage bucket, and keep the AAD outside of Google Cloud.
C) Specify customer-supplied encryption key (CSEK) in the .boto configuration file. Use gsutil cp to upload each archival file to the Cloud Storage bucket. Save the CSEK in Cloud Memorystore as permanent storage of the secret.
D) Specify customer-supplied encryption key (CSEK) in the .boto configuration file. Use gsutil cp to upload each archival file to the Cloud Storage bucket. Save the CSEK in a different project that only the security team can access.

Google Professional Data Engineer Exam - Topic 1 Question 7 Discussion

Actual exam question for Google's Professional Data Engineer exam
Question #: 7
Topic #: 1
[All Professional Data Engineer Questions]

You want to archive data in Cloud Storage. Because some data is very sensitive, you want to use the ''Trust No One'' (TNO) approach to encrypt your data to prevent the cloud provider staff from decrypting your data. What should you do?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Zona at May 06, 2022, 07:57 PM

Limited Time Offer

25%

Off

Get Premium Professional Data Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Antonio
10 months ago
Wait, can you really trust Cloud Memorystore for sensitive keys?
upvoted 0 times
...
Dannette
10 months ago
D is the way to go, keeping it away from everyone else!
upvoted 0 times
...
Brittney
11 months ago
C is a bit sketchy, saving keys in Cloud Memorystore?
upvoted 0 times
...
Chandra
11 months ago
I think B is risky with key destruction.
upvoted 0 times
...
Haydee
11 months ago
Option A seems solid for TNO.
upvoted 0 times
...
Valene
11 months ago
I feel like option D is safer since it restricts access to the CSEK, but I wonder if it complicates the process too much.
upvoted 0 times
...
Gilberto
11 months ago
I’m a bit confused about the customer-supplied encryption keys. Is saving the CSEK in Cloud Memorystore really secure?
upvoted 0 times
...
Teddy
11 months ago
I think option A sounds familiar from practice questions, especially the part about keeping AAD outside of Google Cloud. That seems crucial for TNO.
upvoted 0 times
...
Allene
11 months ago
I remember studying the TNO approach, but I'm not sure if using symmetric keys is the best option for sensitive data.
upvoted 0 times
...
Herminia
11 months ago
Okay, I've got this! The team created during the initial installation is called "zenteam", and it's followed by a GUID. I'm confident that option D is the right answer.
upvoted 0 times
...
Lashaunda
11 months ago
Ah, I remember learning about this in class. I believe the correct answer is D - it provides a conceptual structure for architecture governance. That sounds familiar to me.
upvoted 0 times
...

Save Cancel