3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which Google Cloud service supports Confidential Computing for data processing pipelines?

   • ACloud Storage
   • BCloud KMS
   • CCloud Load Balancing
   • DDataflow
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses CMEK to encrypt a Cloud Storage bucket. An employee with access to the key leaves the company, and the security team suspects the key may have been exposed. The company must immediately stop all new writes to the bucket and prevent any future reads of data encrypted with the suspected key. What should the security team do first?

   • AChange the bucket's default encryption to a new CMEK key.
   • BRemove the IAM permission from the employee's account.
   • CDisable the CMEK key version in Cloud KMS.
   • DDelete the CMEK key from Cloud KMS.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization uses Cloud EKM to encrypt data in BigQuery with keys stored in an on-premises HSM. The security team needs to rotate the keys every 6 months and must be able to revoke access immediately if a key is suspected of being exposed. What should the security team do?

   • ADisable the EKM key in Google Cloud and rely on the external HSM to block access.
   • BDelete the EKM key from the external HSM and recreate it with the same name.
   • CRotate the key in the external HSM and update the EKM configuration in Google Cloud to reference the new key version.
   • DCreate a new key in Cloud KMS and assign it to BigQuery, bypassing the external HSM.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A customer wants to move objects older than 90 days to a cheaper storage class. Which feature should they configure?

   • AObject lifecycle policy with a transition action
   • BBucket versioning
   • CObject hold
   • DCloud CDN
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is choosing an encryption approach for a new application that stores data in Cloud Spanner. The security team has two requirements: (1) the company must be able to rotate keys independently of Google, and (2) the company must be able to prove that keys are protected by hardware, not just software. The company does not want to manage an external HSM. What should the security team choose?

   • ACMEK with a software key in Cloud KMS.
   • BCloud EKM with a partner HSM.
   • CGoogle default encryption.
   • DCMEK with Cloud HSM.
   Reveal Solution Discussion Select an answer first