PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #248
PROFESSIONAL-CLOUD-SECURITY-ENGINEER Question #248: Real Exam Question with Answer & Explanation
Sign in or unlock PROFESSIONAL-CLOUD-SECURITY-ENGINEER to reveal the answer and full explanation for question #248. The question stem and answer options stay visible for context.
Question
You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements: - Manage the data encryption key (DEK) outside the Google Cloud boundary. - Maintain full control of encryption keys through a third-party provider. - Encrypt the sensitive data before uploading it to Cloud Storage. - Decrypt the sensitive data during processing in the Compute Engine VMs. - Encrypt the sensitive data in memory while in use in the Compute Engine VMs. What should you do? (Choose two.)
Options
- AConfigure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded
- BConfigure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to
- CCreate Confidential VMs to access the sensitive data.
- DMigrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
- ECreate a VPC Service Controls service perimeter across your existing Compute Engine VMs and
Unlock PROFESSIONAL-CLOUD-SECURITY-ENGINEER to see the answer
You've previewed enough free PROFESSIONAL-CLOUD-SECURITY-ENGINEER questions. Unlock PROFESSIONAL-CLOUD-SECURITY-ENGINEER for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.