A financial services company must store customer transaction data in BigQuery. Corporate policy requires that the company control the lifecycle of the encryption keys protecting this data, including the ability to rotate and revoke them independently of Google. The company does not need to store keys outside Google Cloud. What should the security team configure?

Use Cloud EKM with a partner HSM to store keys outside Google Cloud.

Create a CMEK key in Cloud KMS and configure BigQuery to use it for the dataset.

Enable Google default encryption and rely on the automatic key rotation performed by Google.

Import a software-generated key into Cloud KMS and use it as a CMEK key.

What is the purpose of wrapping a key during import into Cloud KMS?

To make the key compatible with all services

To encrypt the key so it can be securely transferred

A customer wants to run a Compute Engine VM with Confidential Computing. What must they do when creating the VM?

Select a machine type that supports Confidential Computing

Google CloudProfessional Cloud Security Engineer

Domain 3Objective 2

3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Part of the Ensuring data protection domain, which accounts for 23% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

36questions here

8free pages

12concepts

23%of the exam

Questions 1–5

1foundation · easy
A company wants to automatically delete objects in a Cloud Storage bucket after 30 days. Which feature should they use?
Select an answer first
2foundation · easy
A security engineer needs to create a new customer-managed encryption key (CMEK) for use with Cloud Storage. Which Google Cloud service is used to create and manage the key?
Select an answer first
3application · medium
A financial services company must store customer transaction data in BigQuery. Corporate policy requires that the company control the lifecycle of the encryption keys protecting this data, including the ability to rotate and revoke them independently of Google. The company does not need to store keys outside Google Cloud. What should the security team configure?
Select an answer first
4foundation · easy
What is the purpose of wrapping a key during import into Cloud KMS?
Select an answer first
5foundation · easy
A customer wants to run a Compute Engine VM with Confidential Computing. What must they do when creating the VM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

A company wants to automatically delete objects in a Cloud Storage bucket after 30 days. Which feature should they use?

A security engineer needs to create a new customer-managed encryption key (CMEK) for use with Cloud Storage. Which Google Cloud service is used to create and manage the key?

What is the purpose of wrapping a key during import into Cloud KMS?

A customer wants to run a Compute Engine VM with Confidential Computing. What must they do when creating the VM?

Keep studying — Ensuring data protection