3.2 Managing Encryption at Rest, in Transit, and in Use PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A startup is migrating a customer-facing web application to Google Cloud. The application stores user profile data in Cloud SQL and serves static assets from Cloud Storage. The security team has no dedicated key-management staff and wants to minimize operational overhead while meeting a regulatory requirement that data be encrypted at rest and in transit. There is no compliance mandate requiring customer-controlled keys. What should the security team do?

   • AEnable Confidential Computing on the Compute Engine instances hosting the application.
   • BUse Cloud External Key Manager to store keys in an on-premises HSM.
   • CRely on Google's default encryption at rest and enable TLS for all traffic to the application.
   • DCreate a CMEK key in Cloud KMS and assign it to both Cloud SQL and Cloud Storage.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   A company is required to store encryption keys in an on-premises hardware security module (HSM) managed by a third-party partner. Which Google Cloud service should they use?

   • ACloud KMS with CMEK
   • BCloud External Key Manager (EKM)
   • CCloud HSM
   • DGoogle default encryption
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security team wants to ensure that data encrypted with a CMEK key becomes inaccessible if the key is compromised. What should they do?

   • ADelete the key
   • BRotate the key immediately
   • CDisable the key
   • DRevoke IAM permissions
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare organization is required by its data-protection policy to store encryption keys in a hardware security module (HSM) that it operates on-premises. The organization uses Cloud Storage for archival medical records and needs to encrypt that data with keys that never leave the on-premises HSM. What should the security team configure?

   • ACreate a Cloud EKM key and link it to the on-premises HSM via a supported partner.
   • BUse Google default encryption and store the Google-managed key in the on-premises HSM.
   • CImport a key from the on-premises HSM into Cloud KMS and use it as a CMEK key.
   • DCreate a CMEK key in Cloud KMS and export it to the on-premises HSM for storage.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   A company stores internal training videos in Cloud Storage. They have no compliance mandates and no need to control encryption keys. What is the most appropriate encryption approach?

   • AUse Google's default encryption, which protects data at rest and in transit without customer key management.
   • BDisable encryption because the data is internal and not sensitive.
   • CUse Cloud EKM to manage keys through an external partner.
   • DUse CMEK to maintain full control over the encryption keys.
   Reveal Solution Discussion Select an answer first