Google Cloud Professional Cloud Security Engineer PCSE — Topic 1 Question 228

Question

You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements: • Manage the data encryption key (DEK) outside the Google Cloud boundary. • Maintain full control of encryption keys through a third-party provider. • Encrypt the sensitive data before uploading it to Cloud Storage. • Decrypt the sensitive data during processing in the Compute Engine VMs. • Encrypt the sensitive data in memory while in use in the Compute Engine VMs. What should you do? (Choose two.)

Accepted Answer

Correct answer: B, C. The correct answer is B, C. Option B: Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. Option C: Create Confidential VMs to access the sensitive data. Cloud Storage provides durable, scalable object storage that is fully managed.

Google Cloud Professional Cloud Security Engineer PCSE — Question 228