3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A customer wants to import an existing key into Cloud KMS. What is a required step for key import?

   • AUse a key from Cloud HSM
   • BWrap the key with a public key from Cloud KMS
   • CUpload the key in plaintext
   • DDisable the key after import
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company stores log files in a Cloud Storage bucket. The logs are encrypted with Google default encryption. The company has a data-retention policy that requires logs to be deleted after 90 days. The security team wants to automate this process without writing custom code. What should the security team do?

   • AConfigure a Cloud Storage lifecycle rule to delete objects older than 90 days.
   • BSet the bucket's retention policy to 90 days and rely on it to delete objects.
   • CUse Cloud Scheduler to run a script that deletes objects older than 90 days.
   • DEnable CMEK and configure key rotation to delete the logs after 90 days.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company processes sensitive financial data in memory on Compute Engine instances. The data is encrypted at rest and in transit, but the security team is concerned about an attacker with root access to the host system reading the data while it is being processed. What should the security team use to protect the data during processing?

   • ACloud EKM with an external HSM to encrypt the data in memory.
   • BConfidential Computing with Shielded VMs and Confidential VM images.
   • CA Cloud Storage lifecycle rule to delete the data after processing.
   • DCMEK with Cloud KMS to encrypt the data in memory.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses CMEK to encrypt a Cloud SQL instance. The security team wants to rotate the key every 90 days to comply with an internal policy. The team also needs to ensure that if a key is compromised, they can immediately prevent the Cloud SQL instance from using it. What should the security team do?

   • ARotate the key by re-encrypting the Cloud SQL instance with a new key every 90 days.
   • BDelete the existing key and create a new one every 90 days.
   • CCreate a new key version in Cloud KMS every 90 days and disable the old version if a compromise is suspected.
   • DSet the key rotation period to 90 days in the Cloud KMS key's policy and rely on automatic revocation.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is deploying a new application that uses Cloud Pub/Sub for messaging and Cloud Functions for serverless processing. The data flowing through these services is not subject to any compliance requirements, but the company wants to ensure it is encrypted. The security team wants to minimize operational overhead. What should the security team do?

   • ARely on Google default encryption for both Pub/Sub and Cloud Functions.
   • BUse Cloud EKM for Pub/Sub and Cloud Functions to store keys externally.
   • CEnable Confidential Computing for Cloud Functions to protect data in use.
   • DEnable CMEK for Pub/Sub and Cloud Functions to gain key control.
   Reveal Solution Discussion Select an answer first