Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the…

Question

Options

• AImplement an organization policy that ensures that all VM resources created across your
• BImplement an organization policy that ensures all VM resources created across your organization
• CImplement an organization policy that ensures that all VM resources created across your
• DNo action is necessary because Google encrypts data while it is in use by default.

• A
  14% (6)
• B
  79% (33)
• C
  5% (2)
• D
  2% (1)

Explanation

Encrypting data 'while in use' (i.e., while being processed in memory by a VM) requires Confidential Computing - specifically Confidential VMs, which use AMD SEV or Intel TDX to encrypt VM memory even from the hypervisor. Option B implements an organization policy constraint (compute.restrictCloudComputeService or the Confidential Computing org policy) to enforce that all VMs across the organization must be Confidential VMs. Option D is incorrect because Google's default encryption covers data at rest and in transit, but NOT data in use (in memory) - that requires an explicit Confidential VM configuration. Options A and C appear to describe the same intent as B but with subtle differences in wording; B is the correct formulation for enforcing Confidential VMs organization-wide via org policy.

No community discussion yet for this question.