You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you…

Question

Options

• AExternal Key Manager
• BCustomer-supplied encryption keys
• CHardware Security Module
• DConfidential Computing and Istio
• EClient-side encryption

• A
  6% (2)
• B
  9% (3)
• C
  19% (6)
• D
  66% (21)

Explanation

The correct answers are D and E. End-to-end encryption must cover three states - data in transit, data in use, and data at rest. Option D covers two states: Confidential Computing encrypts data IN USE by encrypting VM memory using hardware-level TEE (Trusted Execution Environment), preventing even Google from reading it; Istio provides mutual TLS (mTLS) for encrypting data IN TRANSIT between services. Option E (client-side encryption) covers data AT REST by encrypting data before it ever reaches Google Cloud, ensuring the provider never sees plaintext. Together D and E cover all three states. Options A (External Key Manager) and B (CSEK) address key management for at-rest encryption but do not cover data in use or transit. Option C (HSM) is a key storage mechanism, not an end-to-end encryption strategy on its own.

No community discussion yet for this question.