Google Cloud Professional Cloud Security Engineer Practice Exam

How should sensitive data encryption requirements be met when using Google Cloud?

1. Encrypt data only before it is uploaded to Cloud Storage.

2. Use Cloud External Key Manager and create Confidential VMs for sensitive data.

3. Encrypt data using Google Cloud’s built-in tools only.

4. Store data in multiple locations and encrypt it afterward.

The correct answer is: Use Cloud External Key Manager and create Confidential VMs for sensitive data.

Using Cloud External Key Manager and creating Confidential VMs is an effective approach to meet sensitive data encryption requirements on Google Cloud. This method enhances security by allowing users to manage their encryption keys externally while leveraging Confidential VMs to protect sensitive data in use. By utilizing Cloud External Key Manager, you maintain control over your encryption keys, which can be stored outside of Google Cloud, thereby reducing the risk of unauthorized access to these keys. This provides an extra layer of security, as it ensures that even if there is a vulnerability within the cloud environment, the keys remain secure and separate. Moreover, Confidential VMs offer hardware-based memory encryption and ensure that sensitive information and computational processes within the VM are not visible to anyone, including Google itself. This is crucial for organizations that need to process and store sensitive data in compliance with regulations and internal policies. This combination of external key management and state-of-the-art VM security provides a robust answer to sensitive data encryption requirements, allowing organizations to confidently meet compliance and security concerns.