In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group…

Question

Options

• AEncrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
• BSet Disk Encryption on the Instance Template used by the MIG to customer-managed key and
• CChange the app instance-to-instance communications from UDP to TCP and enable BoringSSL
• DSet Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use

• A
  84% (27)
• B
  9% (3)
• C
  3% (1)
• D
  3% (1)

Explanation

FIPS 140-2 requires the use of cryptographic modules that are validated by NIST. Google's BoringCrypto module (a subset of BoringSSL) is FIPS 140-2 validated and is the correct tool to use on GCP for FIPS compliance. Option A is correct because it addresses both attack surfaces: encrypting Local SSD cache storage with BoringCrypto and encrypting VM-to-VM communications (including UDP) with BoringCrypto. Option B (CMEK) and D (Google-managed keys) address disk encryption but do not ensure FIPS 140-2 validated algorithms end-to-end, nor do they cover network communications. Option C only changes the protocol from UDP to TCP and applies BoringSSL to network traffic but ignores Local SSD encryption - an incomplete solution.

No community discussion yet for this question.